feat(workbench): add durable restore-to-fork

[wchwawa]

Summary

• add a durable, idempotent workbench restore-to-fork operation with explicit Preparing, ReadyToAttach, Complete, Cleaning/Discarding, and Releasing states
• materialize restored namespaces behind a detached root, seal exact object references and the index overlay, then publish visibility through one final CAS
• preserve restored object-backed files after source pin retirement or source deletion and release references safely after root move, unlink, or rename-replace
• expose a strict capability-gated MCP contract with structured retryable errors and a deterministic restore manifest
• extend fsck, metrics, checkpoint/log replay, HA smoke coverage, crash barriers, and real LingTai/RustFS live acceptance

Storage and compatibility

• pins Holt to fix(storage): make snapshot COW and reopen GC durable holt#29 commit 6f80b53ed66dccfa1778a0dcc15a7e1b656c2d7e
• keeps the existing 40-byte ForkBinding encoding unchanged
• does not change crates/nokv-fuse, nokv-object, nokv-types, generic clone, or generic rollback behavior
• writes an active marker before durable restore metadata is introduced; downgrade requires draining restore state and checkpointing metadata

Validation

• cargo fmt --all -- --check
• workspace/all-features Clippy with warnings denied
• workspace/all-features tests
• nokv-meta: 468 passed, 2 explicitly ignored
• codec/reopen/fsck, clone/rollback/object-GC, snapshot retention and exact-reference release regression suites
• real etcd HA normal failover and stale-owner fencing
• full --require-all RustFS → NoKV serve → MCP → LingTai Agent reconnect → two independent MCP clients live E2E
• 1 GiB COW fixture, 16 durable-create crash phases, cleanup/release crash recovery, concurrent idempotency, nested restore, source retirement, root moves, rename-replace, and final inventory baseline

The public Holt commit resolves to the same tested Git tree (9502163e615f40d4aba288f0d41284659bb3c978); after publishing that commit, dependency metadata/fetch and package-level compile checks were repeated without the local path override. Per maintainer direction, the already-passing full live suite was not rerun solely for the equivalent public SHA pin.

Commit organization

The seven-commit series separates the Holt pin, atomic metadata core (including its invariant tests), complete RPC/API contract, MCP tool, HA smoke, live acceptance harness, and documentation. Every product-code boundary was compiled from its own detached commit; the metadata, API, and MCP boundaries also passed their focused test suites.