fix: validated rkyv access on every disk-read path

[pathscale]

A process that dies mid-write (crash, SIGKILL, an exit without draining) leaves torn pages behind, and access_unchecked read them back as archived values whose relative pointers dangle anywhere in the address space. The reader then died of SIGBUS in whatever touched them next — usually mid-write, tearing the store further. On 2026-08-01 that cascade corrupted one production store (agencyzero's) four times in a single day. Run against the preserved poisoned store, the validator now reports the smoking gun cleanly: InvalidSubtreePointer { address: 5202627079, size: 7679975808 } — a 7.6GB wild pointer that used to be a bus error.

Every access_unchecked on a disk-read path is now validated rkyv::access with bytecheck — including the six inside the Persistable derive templates, which is where the production store's UB actually fired (UnsizedIndexPageUtility::from_bytes). Torn pages now surface as errors naming corruption on fallible paths, or a named panic where the Persistable::from_bytes contract is infallible. Serialization paths and same-process roundtrip tests keep unchecked access: those bytes never crossed a process boundary.

Cost: CheckBytes bounds on the generic read paths (satisfied automatically by every derived Archive type) and validation work at load time only — the in-memory hot path is untouched. All 39 tests pass; consumers compile with six mechanical where-clause extensions (see pathscale/WorkTable#179 for the paired change and the kill-mid-write repro test that this PR turns from signal-death into clean refusal).

Versions bumped to 0.4.1 / derive 0.3.16, ready to publish after merge.

[pathscale]

Addressing the performance concern for latency-critical consumers: a coarse benchmark cannot prove no-impact at the nanosecond scale WorkTable runs at in HFT, so validation is now a cargo feature instead of unconditional. validate-reads is on by default (a torn page is a named error); default-features = false compiles every read back to the exact access_unchecked it was before, zero cost. One switch (access_archived) carries the cfg, the derive templates emit calls to it, and the CheckBytes bounds stay unconditional so the API surface is identical either way. Both configurations build, test, and lint clean.

Structurally, even with validation on: the in-memory insert/select path is untouched (in_memory row access stays unchecked), and validation runs only at table load and inside the background persistence task's disk reads. In-memory writes are never blocked by persistence, before or after this PR.