Make local delete races recoverable

[XIAZY]

Summary

• Treat a stable, revalidated local removal as a real delete: tombstone the
  tracked root entry by its existing document ID after the move/replacement
  correlation window expires.
• Make the final observation-to-commit race recoverable. Persist the root
  tombstone outbox update and an exact root/document local-delete intent in one
  SQLite transaction, retain the tracked identity through send/projection, and
  clear the intent atomically with the successful root projection.
• Before untracking, archive every physical regular-file occupant still
  associated with the deleted document under that document ID. Recovery uses
  both the persisted materialized path and a different current tracked path
  after a post-commit move/rekey.
• Share one physical-occupant classifier across missing-path observation and
  periodic scanning. Regular files and symlinks resolving to regular files
  remain readable document content; directories, dangling symlinks, FIFOs,
  sockets, and other non-regular occupants are skipped without blocking or
  being moved as recovered bytes.
• Preserve the earlier non-snapshot scan re-observation fix and browser-smoke
  teardown diagnostics already carried by this stacked PR.

Root cause

A local rm and the temporary gap in an unlink-and-create replacement have the
same observable prefix. Generation tracking, debounce, and a final path read
can reject stale candidates, but no filesystem read is atomic with the later
root-CRDT tombstone commit. A real stable local removal must still delete the
document, so making all local absence non-destructive is incorrect; conversely,
committing immediately after the last read can tombstone a replacement that
arrived in the final gap.

The durable intent closes the recoverability side of that boundary:

1. Missing candidates are generation-tagged and reversible. Confirmed
   CREATE, WRITE, move, or present-path observations cancel them;
   observation errors retain them for retry.
2. The propagation boundary directly re-observes the path. Present cancels;
   confirmed absence tombstones the root entry by the already tracked ID.
3. The root update and exact local-delete intent commit together. Root send
   failures requeue the root document, and projection/archive failures retain
   the intent.
4. Root-first startup recovery uses the persisted materialized path before any
   in-memory tracked lookup, then also visits a different live tracked path if
   a post-commit move rekeyed it.
5. Any physical regular-file bytes at those paths are archived under the exact
   document ID, including identical-byte replacements. Absent or non-regular
   occupants are left untouched. Only then is identity untracked.
6. Successful projection storage and intent clearing share one SQLite
   transaction, preventing both lost recovery and permanently armed intents.

Explicit remote/UI tombstones keep the existing clean-delete/dirty-archive
behavior. This change does not pretend the local observation and remote commit
are atomic; it makes bytes that arrive after the final cutoff recoverable.

Validation

Exact replacement head: 229e7d0a01f58c4d277d68ba48ecb8be2e19a2ea
(tree cc438a437f50a3936d62e54b9921115361b78d14). All prior head seals are
revoked.

• Focused lifecycle/classifier matrix: GREEN 20x plain and 20x under -race
• go test ./daemon/internal/syncer -count=1
• go test -race ./daemon/internal/syncer -count=1
• go vet ./daemon/internal/syncer
• go test ./... -count=1
• go test -tags=regression -count=1 -timeout 40m ./test/regression — GREEN in
  501.571s with complete compose cleanup
• git diff --check

The focused matrix covers candidate cancellation, observation retry,
pre-commit directory replacement, same-byte and changed-byte post-commit
replacement, persisted/current-path recovery after move/rekey, directory and
dangling-symlink occupants after commit, send retry, archive retry, actual
root-first restart, successful-clear restart, SQLite atomicity, scanner
symlink parity, and a Linux FIFO that must not block or error.

Causal mutations are RED:

• omit intent insertion;
• omit transactional intent clearing;
• omit root requeue after send failure;
• bypass post-commit archival;
• use generic archive and move a directory occupant;
• run restart recovery only after the in-memory tracked lookup;
• omit the current tracked path from the recovery union; or
• restore raw scanner reads and block on the FIFO row.

Hosted exact-head CI run 30671251374 and an independent execution/source
review are required before this draft can be resealed.