rc19

feat(serve): compact repo.secsec at startup so prunes reclaim disk

Client prune and staged-push promotes free redb pages but never truncate the file, so the blind server's repo.secsec sat at its high-water mark forever. Compact once at serve startup — the one exclusive-access moment, before the store is shared via Arc and the endpoint accepts — mirroring the client's existing startup compaction. Best-effort: a failure logs and serves anyway.