fix(state): guard orphan FTS repair admission

[ehz0ah]

What does this PR do?

Prevents orphan FTS shadow repair from deleting a virtual table that another process recreated after a stale preflight check. The preflight now only selects the guarded path. Destructive orphan detection and cleanup run after FTS rebuild admission is acquired.

The repair remains family-specific. Base, trigram, and CJK indexes are rebuilt only when needed. If an optional tokenizer is unavailable or CJK admission is denied, its sync triggers are removed so canonical message writes do not target a missing table. Stale recovery also keeps CJK recreation inside the same admission lifetime.

Related Issue

Refs #108130
Related to #103840

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• Add a read-only orphan-family preflight in hermes_state_fts.py.
• Recheck and remove orphan shadows only while holding FTS rebuild admission.
• Preserve independent base, trigram, and CJK recovery behavior.
• Fail closed by removing optional-family triggers when recreation cannot complete.
• Add concurrency, admission, tokenizer, stale-recovery, and combined-family regressions.

How to Test

1. Run HERMES_PYTHON=/path/to/python scripts/run_tests.sh tests/state/test_fts_orphan_shadow_repair.py tests/state/test_fts_fresh_bootstrap_admission.py tests/state/test_fts_holder_instance_scope.py tests/state/test_fts_index_fail_open.py tests/state/test_fts_rebuild_admission.py tests/state/test_fts_runtime_rebuild.py tests/state/test_fts_trigram_cron_exclusion.py tests/state/test_fts_trigram_subagent_exclusion.py tests/test_fts_cjk_bigram.py tests/test_fts_update_of_narrowing.py tests/test_state_db_fts_segment_collision_probe.py tests/test_state_db_malformed_repair.py -q.
2. Confirm 145 tests pass. Six Linux-only tests are skipped on macOS.
3. Run ruff check hermes_state_fts.py hermes_state_schema.py tests/state/test_fts_orphan_shadow_repair.py.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: macOS

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) or N/A
• I've updated cli-config.yaml.example if I added/changed config keys or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide or N/A
• I've updated tool descriptions/schemas if I changed tool behavior or N/A