feat(core): unify migrations under durable transaction-v1 execution

[jerelvelarde]

Built on merged #32. Closes #31 when this PR merges.

Implements ADR-0007 semantic execution seam, immutable mutation programs, checksummed generations, restart-safe leaf transitions, bounded conflict evidence, legacy compatibility, structured CLI outcomes, and native filesystem safety.

User-visible behavior

• Apply, Recover, and Rollback return structured durable outcomes.
• Crashes resume from checksummed transaction state without silently overwriting user changes.
• Conflicts preserve user bytes and report strictly relative affected paths.
• One retained no-follow root capability spans classification, compilation, and execution.
• Released legacy migration state remains readable and dispatches through its original semantics.
• Ordinary folders remain ordinary folders; Folderbase adds optional protocol state and narratives rather than imposing a new document format.

Publication and recovery invariants

• Journal scratch, stage, and final publication use retained bounded observations and atomic no-clobber rename.
• Recovery never scans an unbounded mutable journal name and never unlinks one by name.
• Oversized, aliased, swapped, directory-shaped, wrong-mode, and symlink-shaped candidates fail closed.
• Interrupted scratch evidence is preserved under a canonical quarantine name.
• Ambiguous legacy final-plus-stage pairs require manual review and preserve both artifacts.
• All protocol paths use portable slash-separated wire spelling.

Hosted-gate root causes resolved

• Linux: cap-std retains no-follow directories with O_PATH. Descriptor operations such as fchmod and fsync returned EBADF. Core now reopens only the fixed dot component through the retained capability before descriptor operations, preserving no-ambient-path authority.
• Linux adversarial fixtures: unlink/create could immediately recycle the same inode, so an alleged foreign object was not physically distinct. Fixtures retain the displaced object until replacement identity is captured.
• Windows: initialization apply uses the same least-privilege, no-reparse directory capability as planning and denies delete sharing. Wire paths and test expectations remain platform-independent.

Risks

• Crash-state convergence and rollback ownership.
• Cross-platform atomic no-clobber behavior.
• Legacy result compatibility.
• Generated 0.5 source-inventory drift.

Verification

• Exact head: 068dead.
• 441 Core tests and 79 migration tests; full CLI/integration workspace suite.
• 228 focused transaction-v1 crash/restart/conflict/rollback adversarial tests locally.
• 193-case transaction matrix on hosted Windows proof before integration.
• Strict Clippy, formatting, CI policy, and public-eclipse checks.
• Frozen 0.4 and 152-file 0.5 closure verification.
• Mutation-sensitive extracted-package tests and isolated folderbase 0.5.0-rc.1 installation.
• Independent final review: GO with P0=0, P1=0, P2=0.