Prove indexed conservation and current tips before retiring packs

[tobi]

Stack, merge in order: #52 → #53 → #54 → #55 → #56 → #57 → #58.
Each PR targets the preceding branch; #52 targets main.

Final pack retirement previously trusted the producer's conservation assertion. The seal now captures manifest, CAS token and current refs together on every attempt, validates the exact current indexes, and rejects either a lost indexed input object or an uncovered current tip before claiming a retirement log entry. A streaming merge uses one cursor per pack instead of an object-sized set; progress is narrated.

The regression uses real Git pack indexes. Plausible already-committed output descriptors cannot hide a lost unreachable input object, and a checkpointed ref introduced after the plan must be covered by the resulting inventory. Refusals leave inputs live; a conserving seal and exact recovery still succeed.

Stack step 7, based on #57. This closes the independent indexed-conservation/current-tip check at seal. It does not complete candidate push/import raw-boundary admission, producer quarantine, adversarial CAS-race twins, seal-evidence cooldown, or backend/client/scale qualification. The full stack remains draft.

Store cost: warm valid indexes add no store requests; missing/corrupt indexes require GETs (HEAD only when old descriptor sizes are unknown), with four downloads in flight. Each attempt adds a local full-ref capture and streaming index scan. No pack materialization or bucket LIST. No constant-time or zero-extra-read claim.

Local validation on the updated stack (2026-09-12):

• Web lint/typecheck/SPA/SDK build, formatting, workspace warning and Clippy gates, unit/integration suites: passed.
• Expanded just ci: passed, including 38 active end-to-end tests, 19 serial fault simulations, and standalone CLI/server smoke. The new simulation/smoke recipes also passed on Add conserving staged pack lifecycle and verified multi-pack bitmaps #54, their first stack layer.
• All six ignored Rust stress/benchmark tests passed: 20k-ref push, 50k-ref cache, 466k-ref advertisement, 500k-ref bookkeeping, 369k-object pack stress, and native/gix comparison on a packed 100-commit synthetic fixture. The optional comparison needs sufficient packed history; initial unsuitable checkout fixtures were replaced.
• Local S3-compatible store contract and two-instance rig: passed, including independent-cache conserving maintenance, exact branch comparison and clone fsck. Real GCS and cloud/edge/client/production-scale qualification were not run.
• just spec-full: all 169 cases passed, with exact mutation/witness verdicts, classifier self-tests and SANY. All three larger reference arms completed; logs in target/test-logs/spec-full-20260912-194501.QHyjqa. No Rust refinement or production-scale proof is claimed.
• git diff --check passed. Stack ancestry and predecessor bases are preserved.

GitHub CI passed on all seven current stack heads, independently checked after local validation. Tip f3998bc: https://github.com/tobi/walgit/actions/runs/34715949051 . The stack remains draft for the implementation and qualification gaps above.