feat(dna): NDO DNA role, per-NDO cell cloning, NdoAnchor in zome_group (#112)

[Soushi888]

Summary

Implements Phase A (backend pilot) of the approved NDO-per-cell architecture: one NDO = one cloned DHT cell, completing the fractal Lobby → Group → NDO holarchy. Implements #112 (child of epic #78); unblocks the amended #110 UI cutover.

Key mechanism (ADR-010): the NDO's immutable Layer 0 fields live in the clone's DNA properties, so the resulting DnaHash is unique per NDO and cryptographically bound to its identity. Immutability is enforced by hash physics; the DnaHash becomes the NDO's permanent, organization-agnostic identifier. The NondominiumIdentity genesis entry lives inside the cell and keeps the mutable lifecycle chain.

Changes

• dnas/ndo/workdir/dna.yaml (new): ndo DNA bundling the existing zome_resource and zome_gouvernance WASMs, integrity and coordinator. No Rust changes to those zomes (ADR-012). zome_person, hREA bridge, and misc stay out of NDO cells.
• workdir/happ.yaml: ndo role, deferred: true, clone_limit: 512 (packed automatically by the existing recursive hc app pack).
• zome_group: new NdoAnchor entry type (appended last in EntryTypes — existing entry indices preserved) with the full clone coordinates (ndo_dna_hash, network_seed, identity_action_hash, initiator, ndo_created_at, regime, nature) plus cached descriptor fields (name, description, lifecycle_stage). Link types GroupToNdoAnchors and NdoAnchorUpdates. Externs create_ndo_anchor, get_ndo_anchors (resolves the update chain), update_ndo_anchor (cache-only mutation; identity coordinates copied from the original entry). This fixes the bare-ActionHash weakness of SoftLink (ADR-011): any reader can re-derive the clone from the anchor and verify the DnaHash as a pinning check. SoftLink survives as a planning-level reference.
• Sweettest (dnas/group/tests/src/ndo_anchor/mod.rs, 6 tests): identity-by-physics derivation (same coordinates → same hash; changed property → different network), genesis identity round trip inside an NDO cell, anchor round trip, cached descriptor sync, empty-name validation rejection, and the full flow — a second agent joins the NDO network from anchor coordinates alone, passing the DnaHash pinning check, and reads the genesis identity.
• Docs: group_zome.md (NdoAnchor entry, links, externs, tests) and architecture_overview.md (ndo role in the DNA topology).

Design refinements vs the architecture doc

• NdoAnchor additionally carries initiator and ndo_created_at: joiners must reconstruct the full DNA properties from the anchor, and those two identity fields are property inputs. They describe the NDO, not the anchor author (the zome_group header convention still applies: anchor author/timestamp come from the action header, so the doc's anchored_by/anchored_at fields are covered there).
• Identity coordinates are immutable across update_ndo_anchor by construction (copied from the original entry), mirroring the immutability the DNA properties enforce inside the cell.

Known pilot limitations (documented in #112)

• zome_gouvernance role-check paths that cross-zome call zome_person (contribution/agreement) will error inside NDO cells; not exercised by the Phase A surface, resolved with the governance-as-operator track (Define cross-zome interface types for governance-as-operator protocol #41 to Governance-as-operator testing infrastructure: mock engine and cross-zome tests #45).
• DNA-properties validation in the integrity zome (genesis entry must match properties) is a Phase D fast follow.
• Open decision (design doc section 10, question 3): retirement of the legacy shared-DHT NDO view is Phase C and intentionally untouched here — all shared-DHT NDO code paths remain functional.

Verification

• bun run build:happ exits 0 and packs dnas/ndo/workdir/ndo.dna
• New suite: cargo test -p group_sweettest --test ndo_anchor — 6/6 passed
• Regression: cargo test -p group_sweettest --test group -- --test-threads 6 — 13/13 passed

Closes #112. Refs #78, #110 (amended — see the amendment comment there), design doc ADR-010/011/012.