feat(git): publish exact-base Gitoxide successors

[zhiiw]

Summary

This stacked Draft adds the second Gitoxide data-plane invariant after repository admission and exact source import:

An owner-bound managed-repository capability can publish a deterministic single-path successor only from its exact base commit, and refs/maka/* advances only through compare-and-swap.

What this proves

• the caller cannot resubmit the managed repository path, accepted ref, or base commit;
• blob/tree/commit objects are derived from the immutable base tree by the short-lived Rust helper;
• the ref transaction uses MustExistAndMatch(base) as the linearization point;
• a stale ref fails closed without overwriting the current accepted ref;
• response loss converges: if the ref already equals the deterministic successor, an exact retry returns the same response;
• a successful result issues the next owner-bound capability, while an old capability can only repeat the same request;
• SHA-256 repositories remain rejected at admission, with the protocol left extensible.

Deliberate exclusions

This PR does not add projection materialization, SQLite accepted-head persistence, Desktop/CLI wiring, Write/Edit execution, or quarantine/GC. Those remain separate owners. M2.2 and M2.4 will be rebuilt only after the Gitoxide data plane and M1.3 composition are complete.

Verification

• Core, Storage, Runtime, and Runtime Host builds pass locally.
• TypeScript owner/decoder tests build and run; real-helper cases are delegated to the three-platform Gitoxide workflow because this Windows workstation has no Rust toolchain.
• The parent source-import PR is green on Linux, macOS, and Windows.
• The helper workflow runs cargo fmt --check, cargo test --locked, the JavaScript build, and real helper authority tests on all three platforms.

Depends on #14. Keep Draft until its three-platform checks are green and the parent lands.

中文说明

这个堆叠 Draft 在 repository admission 与 exact source import 之后，证明第二条 Gitoxide 数据面不变量：

owner-bound managed-repository capability 只能从绑定的 exact base commit 发布确定性的单路径 successor；refs/maka/* 只能通过 CAS 前进。

本切片不允许 caller 重新提交 managed repository path、accepted ref 或 base commit。短生命周期 Rust helper 从 immutable base tree 写入 blob/tree/commit，以 MustExistAndMatch(base) 作为 ref 线性化点；stale ref 会 fail closed。若 CAS 已成功但响应丢失，完全相同的请求会计算出同一个 successor 并返回同一结果，不会多推进一代。

本 PR 明确不包含 projection、SQLite accepted head、Desktop/CLI 接线、Write/Edit 或 quarantine/GC。等 Gitoxide 数据面与 M1.3 composition 完成后，再从最新 main 重建 M2.2/M2.4。

父 PR #14 的 Linux/macOS/Windows CI 已全绿；本 PR 继续由同一三平台 workflow 验证 Rust helper 和真实 JS authority seam。

[zhiiw]

Closed as an obsolete extraction/integration slice. The current delivery path is the merged Gitoxide foundation followed by #40 -> #41 -> #42. This PR remains available as design and implementation history.

中文说明

该 PR 属于旧 extraction/integration 栈，现已失去独立合并价值。当前交付路径是已合并的 Gitoxide 基础，然后依次审查 #40 → #41 → #42。这里继续保留设计、实现与审查历史。