[forhappy]

Canonical current-state catalog sessions capture lazy source ranges without opening browse indexes. The lifecycle audit needs an independent way to hold that session cold while real publication, compaction and GC run.

Extend qualify_remote with qualify_remote <bucket> <prefix> <word-ordered-file-hash> capture-catalog. It opens the normal FileIndexLookupSession, emits a capture handshake, waits for continue on stdin, and then measures cold/warm duplicate lookups. Every returned-error path awaits session close. The full maintenance oracle runs only after measured reads and close.

Stacked on #591 (1fd3251d794); this is qualification tooling, not a catalog-lifetime fix. No foreground production path or data format changes.

Validation

• Release qualifier executable built successfully.
• Strict release example Clippy and format/diff checks pass.
• All compiled source bytes match commit 7f7edfa8fba; source hashes stayed unchanged through the two checks.
• A fresh owned RustFS fixture contains a real 64 MiB file and has no browse readiness or lifetime root. Its baseline canonical catalog query passed. The original source is aging under real provider timestamps for capture -> 532 real pushes -> explicit one-hour repository GC qualification.
• The catalog-only GC test has not run yet. No provider-backed lifetime success, 10 GiB result or broader initiative completion is claimed by this PR.

Review evidence

Boundary	Evidence
Entry point	qualify_remote selection dispatch -> captured_catalog::qualify
Capture owner/callee	Existing FileIndexLookupSession::open_for_storage -> shared authenticated current catalog capture
Cold query	Same session lookup_batch([hash, hash]); no page prefetch or browse builder
Cleanup	Result capture -> awaited session close -> bulk oracle, including failed stdin/query paths
Siblings	Existing catalog-current workload and captured-browse mode remain unchanged
Current main/base	Main lacks this lifecycle probe; #591 has browse-capture qualification but no canonical catalog-session handshake
Test boundary	Compile/Clippy pass; real aged GC and fault/concurrency proof remain pending

Is this the best fix? Extending the existing qualifier keeps its shared measurements and real session API. The probe is intended to establish the catalog-only failure/success before changing lifetime ownership; it does not substitute browse retention for catalog retention.

No dependencies, lockfiles or product configuration added. The requested two audit reports and user-owned advisor-plan edits are excluded.