feat(core): seal captures into transactional Local Head

[jerelvelarde]

Outcome

Implements the FB-41F producer-side capture seal for ordinary mixed-file Folderbases. It verifies approved bytes, installs append-only content/Object Version/Folderbase Version records, and advances a device-local transactional Local Head only after complete verification.

Safety contract

• exact CapturePlan, Folderbase ID, and physical-root binding
• capability-confined no-follow state access and cross-process transaction lock
• bounded journal and future-version preflight before immutable writes
• approved/expected-length-plus-one bounds for source, repeat/no-op, immutable blob, and exact state verification
• crash/retry recovery that preserves the prior Head
• stable identity reuse only from the verified prior Head
• deletions, replacements, and kind changes refuse with TombstonesRequired before Head movement
• least-privilege read_version on Windows
• opaque all-file-type semantics, including large metadata-first assets

Truth boundary

ADR 0005 remains Proposed. This slice does not yet implement productive tombstone authoring, full-state restore, database snapshots, Remote Head, sync, sharing, Cloud, or hosted production.

Verification

• committed RED/GREEN history for seal/recovery, Windows read-only inspection, and three concurrent-growth bounds
• full workspace tests and docs
• Rust fmt and all-target/all-feature Clippy with warnings denied
• protocol/digest vectors, public eclipse, 32-file distribution, package/install proof
• Windows cross-target compile
• independent exact-head review: GO, P0/P1/P2 none