feat(core): restore exact tombstone bytes without clobbering

[jerelvelarde]

Summary

• Restore a current-Head Tombstone into a new absent root with exact sealed bytes, stable Object identity, Object Version, digest, length, and executable fidelity.
• Preserve deletion history and publish a new descendant Folderbase Version and transactional Local Head.
• Add crash-consistent journals, no-clobber cleanup, retained physical authority, namespace-repair refusal, and durable completion retry.
• Preserve genuine released-v0.4 capture and restore journal compatibility.
• Use full physical identities, including all 128 Windows FILE_ID_INFO bits, and versioned Windows root-instance-v2 with exact legacy-v1 admission/recovery.
• Retain migration source/destination authority through destructive recovery decisions.

Safety and compatibility

• Immutable legacy journals, completion receipts, and authority records remain byte-for-byte unchanged.
• Released-root V1→V2 Local Head rebind occurs under the transaction lock before the final comprehensive success proof.
• Final and terminal admission accepts only an exact independently derived recorded-root or current-root full LocalHeadRecord.
• Ordinary edits, same-byte inode replacement, post-CAS crash, second retry, hardlink races, namespace detach, and cleanup substitution fail closed or converge without clobbering.

Verification

Exact reviewed head: 1ac4ad1

• Workspace: 657 passed, 3 ignored.
• Core all-features: 595 passed, 3 ignored.
• Format and diff checks.
• Strict Clippy and rustdoc warnings denied.
• Windows x86_64 MSVC and Linux aarch64 all-feature Core cross-checks.
• Package/install proof: Core 57 files, CLI 10 files, extracted package tests, installed folderbase 0.4.0.
• CI policy, public eclipse, distribution, Folderbase Version digest, and reorganization vectors.
• Two independent exact-head reviews: GO, P0/P1/P2 = 0/0/0.