Prepare local retention lifecycle records and durable backend gate

[Exohayvan]

Prepare explicit local retention lifecycle records without claiming that retention is durably committed. This slice adds a pure bounded contract and defines the required atomic persistence/ownership gate; it does not implement a database backend, hosting, serving, restoration, deletion or quota release.

Pin store/policy declarations, exact admission/project/manifest/fragment bindings, original directory/database identities, artifact expiry and explicit duration/record limits. Acceptance and renewal require a supplied verified selected-fragment observation and hash its complete supplied ledger/observation evidence. Track global and selected-admission revisions separately; reject backward clocks, stale metadata, lower observed charges, wrong bindings, missing/corrupt/quarantined data and budget violations. Renewal must precede and extend the prior deadline. Expiry is explicit and terminal, preserving the last evidence/accounting observation. Exact operation retries return the current history without resurrection; conflicting reuse or stale new operations fail. Reserve the final record slot for expiry.

Version-1 canonical encoding is capped at 64 KiB and 2–64 records, with chained digests rooted in exact terms and a checked envelope checksum covering every term and the final record. These are accidental-corruption/binding checks, not authenticity, freshness or ownership proof. durable_committed and retention_confirmed remain false. Supplied reports/terms are metadata; only a future backend's fresh locked audit plus original-ledger transaction can establish the tested local custody boundary. Lost-binding restoration remains blocked, and existing admissions stay fully charged.

The persistence specification requires explicit schema enablement (never missing-table recreation), one active intent per admission, original-store writer/transaction fencing, fresh bounded verification, atomic event/idempotency/revision/clock records, acknowledgment-loss reconciliation, terminal expiry and unchanged 4-MiB/4,096-revision ceilings. It lists process/concurrency/crash/rollback/copy/corruption tests still required before durable completion. No network or independent retention guarantee is introduced; STORE-1 remains incomplete.

Ten focused tests cover lifecycle/codec roundtrip, replay/conflicts, clock and interval bounds, reserved expiry capacity, binding/status/quota checks, complete observation commitments, stale per-admission revisions, corruption and cancellation. Python 3.11 focused tests pass with ResourceWarning as error. Installed acceptance prepares records from a real disposable owned-store audit and checks that the actual ledger is unchanged. Native fast gate passed: 1,372 tests / 2,724 subtests, required coverage, lint/format, strict typing and repository policy checks. Wheel/sdist and installed acceptance passed. Zero source clones/dead-code findings and no new E-level complexity. All 24 fresh hosted checks passed on the corrected head, including build/install, coverage, security, secret scan and repeatability. Mutation not run. This is preparation only, not durable retention evidence. Hold for independent review.

Review head: d2eac7c419da8b3ebade7653c31c6538d0c47844; tree b41a0133c861f4da4e4cdd3db0227b817abc3c42. Base: merged PR327 2bcefb5e77a704dbd883390b18aa217f1e2a9ecd. No admission/ownership database code or resource ceilings changed.

Independent-review correction: mutations to final until/at/op ID/evidence/revisions/charges/action/previous digest and initial intent/terms/record presence now fail unless the envelope checksum is recomputed. Deliberately recomputed unsigned metadata still parses without granting authority.

[Exohayvan]

Superseded by the reviewed consolidated change merged in #330 at bc2b874. This PR’s complete changes are included; its branch is preserved.