Harden collection authority and canonical runtime safety

[callumalpass]

Summary

• bind all collection reads, scans, publications, journals, feeds, resources, views, cache freshness, migrations, and watcher rescans to held no-follow capabilities
• bound snapshot capture and propagate caller cancellation through canonical runtime work
• make canonical outcomes checked and journal v4 transition evidence authenticated
• expose complete resolver reasons/alternatives and fail closed on malformed evidence
• isolate legacy CRUD/wire compatibility behind measured feature and architecture inventories
• migrate command/runtime/testbed canonical graphs off legacy mutation features
• add a syntax-aware closed ambient-I/O surface and Windows handle-relative atomic replacement

Stack

Stacks on #72. Paired Connect consumer: mdbase-dev/mdbase-connect#361 (once created).

Qualification

• full workspace/all-feature and no-default feature matrices
• strict Clippy and rustdoc
• architecture, compatibility, and feature-graph guards
• pinned v0.3 conformance at spec 5aa34fd14de2e0ae9e565425b724b306046b64ca
• deterministic replacement-root, bounded capture, cancellation, resolver, recovery, and journal adversarial tests
• independent hostile review: ACCEPT
• Windows all-target/all-feature check and tests added to CI; replacement uses held handles and FileRenameInfoEx