feat(storage): atomically accept managed workspace successors

[zhiiw]

Summary

Establish the SQLite authority that atomically accepts a successful tool outcome and its managed-workspace successor.

Primary invariant

A successful tool response, immutable successor fact, workspace-version projection, and canonical workspace head are either committed together or not visible at all.

• Owner: SQLite runtime store
• Atomic boundary: one SQLite transaction with head CAS
• Failure state: transaction rollback / fail-closed corruption
• Rollback: derived projections can be rebuilt from immutable RuntimeEvents

What changed

• defines causal workspace successor facts and validation
• adds the single atomic successor bundle writer
• makes the canonical head and projection rebuildable from RuntimeEvents
• rejects failed outcomes, identity mismatches, invalid causal order, and conflicting retries
• documents the M2 extraction plan and authority boundary

Stack position

This is M2.1, the first Draft in the managed mutation stack.

Base: main
Next: codex/managed-workspace-git-mutation-candidate-m2-2

Validation

Focused core/storage builds, persistence tests, transaction rollback/reopen tests, projection rebuild tests, and SQLite crash/concurrency coverage passed on the implementation branch.

Draft limitations

• no production Write/Edit consumer yet
• this Draft has now been replayed onto the current main; later main drift must still be handled before Ready

中文说明

概要

本层建立 SQLite 的唯一接受权威：成功工具结果、不可变 successor fact、workspace version 投影和 canonical head 必须在同一个事务里全可见或全不可见。

• Owner： SQLite runtime store
• 原子边界： 带 head CAS 的单个 SQLite transaction
• 失败状态： 整体回滚或对损坏证据 fail closed
• 恢复方式： 所有投影均可从不可变 RuntimeEvents 重建

这是 M2.1，也是整个 managed mutation Draft 栈的第一层。目前没有生产 Write/Edit consumer；本轮已经从同步后的最新 main 重放，转 Ready 前若 main 再次漂移仍需重新同步。

[zhiiw]

Closed as an obsolete extraction/integration slice. The current delivery path is the merged Gitoxide foundation followed by #40 -> #41 -> #42. This PR remains available as design and implementation history.

中文说明

该 PR 属于旧 extraction/integration 栈，现已失去独立合并价值。当前交付路径是已合并的 Gitoxide 基础，然后依次审查 #40 → #41 → #42。这里继续保留设计、实现与审查历史。