[codex] Add bounded manual Inventory block groups

[SadPossum]

Summary

• promote manual block groups to first-class, versioned Inventory aggregates with property-safe membership
• add bounded preview/confirmation with a hard 500-member atomic limit and truthful 501+ refusal
• add atomic immutable-definition replacement, partial/full release, exact replay and lost-response recovery
• add property-local date handling, selection epochs, repeatable-read previews and contention-safe retry mapping
• expose bounded group/member reads and mutation recovery across Public API, Admin API and actual Admin CLI execution
• add least-privilege permission/role metadata, actor evidence, no-store behavior, tenant export/destruction and privacy catalogue coverage
• add a single PostgreSQL convergence migration with legacy backfill, provider integrity triggers, upgrade locks and downgrade refusal

Scale and operations

The synchronous path never silently activates a broad target in batches. A target of 500 members commits parent, children, availability fences, receipt and outbox facts in one transaction; 501 returns TooLarge without effects. Group and member history use opaque keyset cursors. Replacement creates a linked successor atomically, so sellable capacity is not exposed between release and recreate.

This is intentionally an Inventory-owned product protocol. GMA receives only the generic rollback-reset hygiene required to clear a scoped EF unit of work after transactional failure.

Verification

Definitive final-candidate evidence at 7eeed9c60479e6dacf74f5bd1160462b28a3f18a:

• warning-as-error solution build: 0 warnings / 0 errors
• full non-Docker solution: 5,266/5,266 across 42 TRX files
• migration drift: 21/21 contexts clean
• solution sync, source-package, repository security/release and diff gates: green
• Inventory unit suite: 239/239
• real PostgreSQL migration/protocol matrix: 13/13
• real PostgreSQL concurrency, replacement, authorization, Admin API and real Admin CLI matrix: 7/7
• EF pending-model check: clean
• independent final audit: P0=0, P1=0, P2=0
• candidate clean and 1 ahead / 0 behind frozen origin/dev

Dependencies and known external gates

• Depends on GMA Framework draft PR #24: [codex] Reset scoped unit of work after rollback GMA-Framework#24
• Framework #24 is open/clean and all hosted checks pass.
• Hosted backend validation currently stops at the expected submodule-head gate because PR #24 is not merged into Framework dev; Security Baseline and Trivy are green.
• The separate test-only SSH.NET advisory is remediated in backend draft PR [codex] Pin patched SSH.NET across backend test harness #14 and seven upstream module/framework PRs; this feature does not broaden that dependency graph.

No migration, deployment, or production rollout has been performed.