feat: move durable runtime state to user data directories

[AllureCurtain]

Summary

• add one bootstrap-owned, cross-platform user data root with stable per-workspace storage keys and marker-verified workspace directories
• route first-party runtime state, SQLite, memory, MCP catalogs, and the API-global ProductStore through the shared contract while preserving explicit path overrides
• add rove state paths and conservative dry-run/apply/prune migration with locks, journals, SQLite snapshots, conflict backup, symlink/reparse fail-closed checks, and safe recovery
• transactionally rebase legacy absolute SQLite artifact paths so exact resume still works after legacy pruning
• preserve M1 legacy discovery until contract runtime state materializes, then require marker-bound contract artifacts
• make Product MCP reads side-effect free and promote a legacy catalog exactly once on the first marker-bound Settings mutation without letting later legacy data overwrite the contract
• isolate local/provider integration runners with disposable ROVE_DATA_ROOT values and update current runtime/design/operator documentation

Verification

• cargo fmt --all --check
• cargo clippy --workspace --all-targets -- -D warnings
• cargo test --workspace -j 1 — all package, integration, and doc tests passed
• cargo test -p rove-app-bootstrap --test state_migration -- --nocapture — 23 passed
• focused bootstrap discovery, Runtime MCP config, API marker/MCP, and SQLite error regressions passed
• scripts/state-migration-smoke.ps1 -CargoRoot "" — 19/19 under PowerShell 7
• powershell -ExecutionPolicy Bypass -File scripts/state-migration-smoke.ps1 -CargoRoot "" — 19/19 under Windows PowerShell 5.1
• Web: pnpm test (241), pnpm typecheck, pnpm build, pnpm test:e2e (56 passed; 5 real-API-gated cases skipped in the mocked run)
• isolated non-default-port local-full — all 5 live real-API Playwright cases passed
• git diff --check and changed-Markdown link/fence/heading audit

The first default-parallel workspace test attempt hit the Windows linker shared PDB ceiling (LNK1318: PDB LIMIT (12)) without a Rust assertion failure. The authoritative serial rerun above completed with exit code 0.

Unverified optional gates

• credentialed external Provider
• real third-party/official filesystem MCP interoperability
• installed/signed Desktop journey
• macOS/Linux packaging and execution
• Windows ConPTY
• broader stress/soak