feat(ingest): add durable transactional batch backend

[shivros]

COD-437 — transactional ingest baseline

Implements the approved first slice only: a source-agnostic, durable IngestStore::apply_batch contract and local filesystem backend. It deliberately does not add a provisional HTTP endpoint, shared-secret auth, or generated surface; those follow against this stable persistence boundary.

Included

• Typed normalized contact/thread/message/archive mutations, cursor, audit, and replay outcomes.
• Canonical order-sensitive SHA-256 batch hashing; matching replays are idempotent and content conflicts do not write.
• One locked, atomically renamed filesystem snapshot for mutations, replay record, cursor, and audit.
• Structured source namespaces for replay and archive identities.
• Herdr adapter with bridge-owned replay/audit identity; blank bridge IDs are rejected.

Validation

• cargo test -p iris-storage (8 passed)
• cargo test -p iris-core (31 passed)
• cargo test -p iris-providers herdr (10 passed)
• cargo clippy --workspace --all-targets -- -D warnings
• cargo fmt --all -- --check
• cargo run -p iris-codegen --bin iris-codegen -- check
• git diff --check

imap-proto v0.10.2 retains its pre-existing future-incompatibility warning.

Closes COD-437.

[shivros]

🤖 Automated Review Panel

GPT-5.6 (openai/gpt-5.5)

Initial review identified durability/error-contract, replay-key namespace, blank bridge-ID, and archive-key namespace defects. All were fixed with regression coverage. The final focused review found one remaining post-commit error path (File::open of the parent directory after rename); fixed in e3cd492 by opening the directory before commit. Focused validation: workspace tests and strict clippy passed.

---

Gemini 3 Flash (google/gemini-3-flash-preview)

APPROVE after the durable directory-sync attempt, structured replay namespaces, blank bridge-ID rejection, and no post-commit unlock error. Workspace tests and strict clippy passed.

---

The panel's final concrete blocker was addressed before this PR was opened: no fallible operation remains after the snapshot rename that could return Err for an already-visible batch.

[shivros]

Auto-Merge Gate

Confidence: 0.90

This PR fulfills the explicitly approved first COD-437 slice: a source-agnostic transactional IngestStore baseline, durable local backend, replay/conflict semantics, and Herdr adapter. The ticket’s direction explicitly defers generated HTTP/MCP/CLI surfaces and shared-secret auth to a follow-up against this stable boundary. CI passed: Test, Format Check, Clippy, Secret Scan, Dependency Audit, and Creed context drift. The dual-model review panel’s durability findings were addressed with regression coverage before handoff.

Scope limit: generated ingest API/auth wiring remains tracked as follow-up work; this merge completes only the approved persistence baseline.