Refuse to replay a run stamped above core's SPEC_VERSION_MAX_SUPPORTED on every World #4407

From the formal-model review of #4327 / #4366 / vercel/workflow-server#1044 (#4406, findings C4, E1 and W1).

requiresNewerWorld is only called in world-local and world-postgres, and it compares against the World package's SPEC_VERSION_MAX_SUPPORTED, not core's. On the Vercel path nothing refuses a run whose specVersion is above what the executing core can read. Such runs are reachable through:

• an explicit start({ specVersion }), a same-deployment replay, or a CLI fallback stamp above the target's version (C4). The model shows an explicit 8 on a spec-7 or stable victim unlocks hook force-claim, and the victim's await hook is stranded.
• a package skew where world-postgres is newer than core (W1).

Fix: in core's runtime, before replaying, fail closed (the same error requiresNewerWorld raises) when run.specVersion > SPEC_VERSION_MAX_SUPPORTED from @workflow/core's own view, on every World. This is one check, and it covers all of the above. (E1, where an executor attests more than it was validated for, is fixed separately in #4366.)