AOCI-CODE v0.1.0-rc15

AOCI-CODE v0.1.0-rc15 is built from 8ba516a01ac7020f8abce64bf4bd3fda46098fb0.

Five fixes for the first index and for recovery, plus three contributor
changes. A repository that holds an image, an empty file, or a file above
1 MiB now reaches aligned in auto mode: such files are held out of authoring
and reported, never handed to a decision Volumes v1 cannot make, which is
where the first scan of a project holding one stopped under v0.1.0-rc14. A stale
receipt under .aoci/transactions is seen by every surface and closed by the
tool that wrote it (#74). Contributor changes: catalog transaction options per
engine (#72), aoci scope activate (#73), and a nested-worktree index read
from the primary checkout (#78, fixes #77). Existing indexes are not
rewritten, every machine-written index that aligned under v0.1.0-rc14 aligns
here, and the nine tools accept the same inputs. aoci verify --json gains
code_drift.skipped, code_drift.curation_excluded, and
governance.pending_transaction_files; aoci scan --json gains
skipped_sources.

• Read an index authored in a nested git worktree from the primary checkout
  (#78, fixes #77). When the recorded root lies below the invocation root and
  every section belongs to that family, the reader now resolves the family
  against its recorded root instead of filing each Entry under the worktree
  path, so the primary checkout, the worktree, and an unrelated clone read one
  index. A single-section index stays ambiguous and keeps its direct reading.
  The upgrade axis gains a fifth shape that authors a fixture inside
  .worktrees/wt with each released binary, merges it, and reads it from the
  primary checkout with the binary under test: 40 checks per released version.
• Hold empty, binary, and oversize sources out of authoring instead of stopping
  the first Maintain on them. An index-role file whose bytes carry nothing a
  model can read (empty, a NUL byte in its first 8000 bytes, or above 1 MiB)
  is reported as code_skipped with its cause, listed under
  code_drift.skipped, never planned, and never blocks; an index-role file
  kept out by a valid curation decision is reported as
  code_curation_excluded. Verify, Check,
  Guide, and Maintain read one classification, so none of them counts a file
  another never plans. Releases up to v0.1.0-rc14 stopped the first Maintain of
  any repository holding an image with pending_curation: markers in
  orphan_remove_candidates, and Volumes v1 has no decision path that could
  have cleared them. scan announces the counts (skipped_sources under
  --json), a held file can still be authored directly, and a Maintain that
  names candidates always carries authoring_meta and instructions. The
  lifecycle governance walk now asserts the held-out probes reach aligned in
  auto mode, and scenario F11 covers a fresh repository with all three kinds:
  61 scenarios.
• Detect pending recovery receipts in one place (#74). Every receipt kind
  written directly under .aoci/transactions/ (bootstrap, migration, reversal,
  scope, database bootstrap, remove, entries, header) and any foreign .json
  file there is pending for Overview, Verify, Check, Guide, Maintain, the CLI
  gate, every transaction start, and the remove and update commit paths alike,
  which refuse to write over any receipt that is not their own. Releases up to
  v0.1.0-rc14 refused
  full cognition delivery on a stale remove-*.json while Verify reported the
  repository aligned and nothing named the file. Verify lists
  pending_transaction_files, each receipt is its own recovery_pending
  finding with its kind as the cause, and the Guide stops on the file with the
  closure that fits it. aoci_remove_entry closes a receipt the Volume has
  moved past: with the object absent the receipt completes as superseded and
  neither the Volume nor the Baseline is touched; with the object still present
  and unchanged the receipt is discarded and the removal re-planned, both under
  the index lock and on the Ledger; an object that came back changed still
  refuses with recovery_entry_reappeared. A Legacy index closes its receipts
  the same way; a receipt the tool cannot load or resume, and a layout receipt
  pending beside an MCP receipt, have their documented order of closure.
  verify, check, status, scope status, remove-entry, and the Guide
  stay available while an MCP write receipt is pending.
• Report every repairable candidate of a batch in one repair_required
  response instead of stopping at the first; retry_scope names them all.
• Keep every fingerprint's index role when a batch advances the Baseline under
  Managed Scope; the batch path wrote roleless fingerprints over the ones scan
  had stamped.
• Add aoci scope activate (#73, #54). After editing rules, a budget, or the
  approval mode, one command builds the empty candidate set and runs the
  existing Scope Change preview and Apply. When the preview needs a human, it
  stops with exit 2, keeps the preview in a fresh directory under
  .aoci/scope-change/, and prints the scope approve and scope apply
  commands bound to this executable and repository; --json carries them
  under details. It edits no rules and authors no Entries, and every
  existing refusal stands. The four-line candidate-set recipes in the
  documentation are replaced by the command; the spec gains a section, and
  a fault-injection scenario (F10) covers activation over retained source
  drift and the approval pause.
• Select catalog transaction options per database engine (#72). PostgreSQL,
  MySQL, and openGauss keep their repeatable-read, read-only transaction; an
  engine without a policy fails closed before any connection is used, and the
  collector test now asserts the isolation level as well as the read-only flag.
  Groundwork for further engines; no behaviour change for the three supported.

See docs/install.md and docs/supply-chain.md for asset verification.