feat(storage): own immutable managed mutation candidates

[zhiiw]

Summary

Freeze an owned managed-worktree mutation into an immutable, operation-bound Git candidate before SQLite accepts a new canonical workspace version.

Primary invariant

A mutation candidate is derived from the exact accepted base, declared path set, workspace policy, and operation identity; it is never itself the accepted workspace truth.

• Owner: Git workspace service candidate authority
• Atomic boundary: private index + deterministic tree/commit + candidate-ref CAS + durable receipt
• Failure state: conflict, drift, corrupt receipt, or incomplete publication parks/fails closed
• Rollback: discard tombstone and idempotent candidate cleanup; accepted truth remains unchanged

What changed

• creates deterministic immutable Git mutation candidates
• binds candidate identity to base, operation, paths, and policy
• validates nested add/modify/delete paths recursively
• revalidates every durable receipt field from authoritative inputs
• adds idempotent capture/discard crash recovery and shared recovery-test inventory

Stack position

This is M2.2 and must be reviewed as the delta from M2.1.

Base: codex/managed-workspace-mutation-version-authority-m2-1
Next: codex/managed-workspace-mutation-reservation-m2-3a

Validation

Focused Git candidate tests, nested-path regressions, exact-retry checks, real child-process capture/discard crash tests, and platform recovery inventory passed on the implementation branch.

Draft limitations

• a candidate is not an accepted workspace head until later stack layers consume it
• no production Write/Edit consumer yet
• final delivery must be rebuilt from latest upstream/main

中文说明

概要

本层把 managed worktree 的变化冻结成 operation-bound 的不可变 Git candidate。candidate 只是一份可验证的候选物，不是 accepted truth；真正的 canonical head 仍由 RuntimeEvents + SQLite authority 决定。

• Owner： Git workspace service candidate authority
• 原子边界： private index、确定性 tree/commit、candidate ref CAS 和 durable receipt
• 失败状态： drift、冲突、receipt 损坏或发布不完整时 fail closed
• 回滚方式： discard tombstone 与幂等清理，accepted head 不推进

这是 M2.2，只应相对 M2.1 审查。最终仍需从最新 upstream/main 重建。

[zhiiw]

Closed as an obsolete extraction/integration slice. The current delivery path is the merged Gitoxide foundation followed by #40 -> #41 -> #42. This PR remains available as design and implementation history.

中文说明

该 PR 属于旧 extraction/integration 栈，现已失去独立合并价值。当前交付路径是已合并的 Gitoxide 基础，然后依次审查 #40 → #41 → #42。这里继续保留设计、实现与审查历史。