Pre-1.0.0 correctness & safety hardening

[leogdion]

Tracking issue for a coordinated correctness, safety, observability, and code-quality pass before the 1.0.0 release. Six of these came out of the PR #298 (v1.0.0-beta.1) review; #38 is a pre-existing data-size TODO addressed alongside.

Children are tracked as actual sub-issues — see the panel above.

Status notes

• Silent platform fall-through in Credentials+TokenManager.swift hides credentials on older platforms #348 — deferred; @available cascade needs its own pass.
• LoggingMiddleware logs raw CloudKit auth headers at debug level #350 — deferred; design choice between inline filter vs. building a SecureLogging helper.
• Handle Data Size Limits #38 — in-scope sub-fixes: per-record 1 MB and per-asset 15 MB pre-flight validation; auto-chunking of >200-record modify batches deferred.

Initial branch

pre-1.0-correctness-hardening — closes #349, #351, #352, #353, and the in-scope portion of #38. #348 and #350 remain open under this umbrella.