feat(runtime-host): gate accepted Gitoxide ref projection

[zhiiw]

Summary

Add the accepted-ref projection boundary for managed Gitoxide mutations.

• extend the short-lived helper with an exact promote_candidate CAS operation
• validate candidate commit/tree/blob/request identity before moving the accepted ref
• treat an already-promoted candidate as exact replay success and reject any third ref value
• issue projection authority only after the SQLite successor transaction commits
• require the durable candidate owner to hold that opaque projection capability before promotion
• issue a new accepted-repository capability for the promoted immutable tree

Primary invariant

refs/maka/accepted can advance from the exact base commit to the exact candidate commit only after SQLite has atomically accepted the corresponding tool outcome, workspace successor, and canonical head. Crash recovery may replay that CAS, but may never rerun Write/Edit or overwrite a third ref value.

Ownership / atomicity / failure

• accepted truth owner: SQLite workspace successor authority
• projection coordinator: durable Gitoxide candidate authority
• ref CAS data plane: short-lived Gitoxide helper
• SQLite commits first; Git ref projection follows as an idempotent derived operation
• candidate drift, ref drift, or capability mismatch fails closed
• an indeterminate ref update is retried from durable facts; no tool side effect is repeated

Verification

• Core Storage and Runtime Host builds pass locally
• focused execution-store and Gitoxide boundary tests pass locally
• Rust formatting and TypeScript formatting pass
• real Rust helper tests run in the three-platform Gitoxide CI lane (local Windows lacks MSVC link.exe)

Stacked on #32.

中文说明

本 PR 新增 managed Gitoxide mutation 的 accepted-ref projection 边界。

主要不变量是：只有 SQLite 已经在一个事务中接受 tool outcome、workspace successor 和 canonical head 后，refs/maka/accepted 才能从精确 base commit CAS 到精确 candidate commit。进程崩溃后只能重放这个 CAS，不能重新执行 Write/Edit，也不能覆盖任何第三个 ref 值。

权限被收窄为三层：SQLite 签发不可伪造的 projection capability；durable candidate owner 同时验证 receipt 与该 capability；短生命周期 Gitoxide helper 只执行经过完整 candidate 身份验证的 ref CAS。已经推进到 candidate 时返回精确重放成功，candidate/ref/capability 任一漂移都 fail closed。

[zhiiw]

Superseded by the rebuilt delivery stack #40 -> #41 -> #42. This extraction PR remains available as implementation and review history; no validated logic was discarded.

中文说明

该 extraction PR 已由从最新 main 重建的组合交付栈 #40 → #41 → #42 替代。这里仍保留实现与审查历史，已验证逻辑没有被丢弃。