[Feature] Persistence contract polish: integrity hook, InMemory snapshot keepN, prune policy

[pathosDev]

Size / Priority

• Size: M — three independent pieces.
• Split out of [Feature] Persistence contract polish (close, integrity hook, InMemory snapshot keepN, prune policy, ByTag TagFilter) #393, whose two cheap parts have landed.

Rationale

#393 bundled five contract-polish items. Two shipped in the current release window and are closed with it:

• close?() on DurableStateStore — it was the only one of the three persistence contracts missing the teardown hook that Journal and SnapshotStore already had.
• ByTagProjectionOptions.tag widened from string to the full TagFilter, so a projection can express all / any / not instead of one tag. (Needed a stable cursor-key derivation — tagFilterCursorKey — because OffsetStore is keyed by string; a bare string maps to itself so existing cursors keep resolving.)

The remaining three are unrelated to each other and to those, so they are tracked here rather than keeping #393 open:

Scope

• integrity() hook on DurableStateActor — so an actor can opt into the HMAC integrity check that the object-storage store already supports ([Security] DurableState revision tampering via JSON-body manipulation #116) without reaching for store-specific options.
• keepN on InMemorySnapshotStore — every other snapshot store honours a retention count; the in-memory reference grows without bound, which makes it behave differently from the thing it is a reference for. Also: upsert-on-same-sequence, which the relational stores do and this one does not.
• Prune policy for durable state — a documented, store-agnostic way to drop deleted entries. Closest thing to the concern raised in [Security] No default snapshot-policy guidance for DurableState #107 (closed as invalid: DurableState keeps one record per id, so there is no revision log to bound — but pruning deleted rows is a real gap).

Acceptance criteria

Each item independently landable, with the shared persistence contract suite extended where the behaviour is cross-backend.