[codex] Consolidate Reservations operations and recovery

[SadPossum]

What changed

• consolidates the durable Reservations stay-amendment workflow and the property-local operations snapshot into one branch instead of shipping overlapping Reservations PRs
• keeps current Reservation and Inventory truth authoritative while a desired stay amendment is pending, then records durable applied, rejected, or outcome-unknown evidence with bounded reconciliation
• exposes the same property-scoped operations snapshot through Public API, Admin API, and Admin CLI, using projected IANA time-zone truth and bounded upcoming results
• hardens Reservations retention with monotonic lease-generation fencing, safe failed-attempt rewind, exact PostgreSQL timestamp replay, tenant isolation, and a single-statement bounded policy/acknowledgement snapshot
• registers Reservations as a Data Rights processing-restriction owner, with bounded release-target discovery, exact target/version binding, actor-bound immutable replay proof, and fail-closed exactly-one legacy recovery
• carries the combined governance, export, tenant-destruction, migration, documentation, and recovery evidence under the settled Reservations catalogue coordinates

Consolidation

This PR now includes the work previously proposed in #17. No additional Backend PR was opened for the retention or restriction follow-ups; they are part of this single Reservations candidate.

Validation

• canonical restore: passed
• strict serial Release solution build: 0 warnings, 0 errors
• all 44 solution test projects with Category!=Docker: 5,629/5,629 passed, 0 failed/skipped/not-executed
• consolidated PostgreSQL/NATS Reservations admission: 25/25 passed
  • focused retention provider replay/bounds/recovery: 2/2 passed
  • central Data Rights restriction target selection, apply/release, replay, and ordinary-mutation recovery: passed
  • stay-amendment migration/dispatcher, operations snapshot, and both saga recovery scenarios: passed
• migration drift: 21/21 provider contexts clean
• solution synchronization, source ownership, repository security/release, and diff checks: passed
• submodules: 10/10 current commit = recorded gitlink = live dev
• vulnerability audit: 300/300 projects parsed, zero vulnerable top-level or transitive packages
• independent settled-diff review: no remaining P0-P2 production defect

Evidence boundary

The changed-actor and ambiguous legacy-unbound restriction paths are unit-proven and fail closed. A dedicated PostgreSQL crash-window replay and migrated legacy-null-target scenario remain bounded P2 proof debt, not a known source defect.

Deployment boundary

This is code plus local/provider evidence only; it is not deployed-production evidence. No deployment is performed by this PR. The stay-amendment migration still requires the documented stop/drain, migration, matching-artifact deployment, verification, and resume sequence.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.