v7.224.2

• T-1001: the canonical sub-sync ownership receipt is now the one whose OWN created_at is newest, never the operation.json filesystem mtime -- a copy or touch can push an older committed inventory's mtime forward and feed the wrong obsolete reconciliation. Receipts sharing the newest committed second with different inventories are ambiguous and fail closed (sync refuses, zero writes); a receipt with a broken durable timestamp is never selected and a fresh sync self-heals. Six hostile lineage controls plus the obsolete-delete and crash-resume controls pass.