Prepare complete validated native metadata retention DAGs

[Ivanbeethoven]

Native metadata retention needs the complete canonical MTP2 page graph, including internal radix pages and child-directory roots, before a fixed native tree can be retained. This change adds an explicit preparation API and a validated payload/node/edge group compatible with the existing PostgreSQL retention-group format.

The validator checks codec-domain digests, actual sizes, canonical directory rebuilding, branch counts, exact page references, uniqueness, complete reachability and acyclicity. Preparation is bound to the storage-owned tagged root tree OID, scope and full projection profile/revisions. Caller budgets can only tighten absolute node, edge, entry, payload and preparation-work ceilings; projection lower-bound checks reject impossible budgets before fetching unavailable children.

Repeated preparation returns a validated immutable DAG from a memo capped across all roots at 64 MiB of accounted residency and 16 entries. This is separate from the existing 64 MiB directory-page cache. Outstanding caller Arcs, allocator overhead and other request state are outside these cache limits; they are not a global RSS/admission bound.

Scope: metadata preparation only. The fixed identity is a root tree, not a commit/publication proof. This change does not persist payloads, integrate the runtime or leases, change lease success, enable physical GC, or include content chunk maps/locators. It is stacked on #38.

The existing occupied-port runtime regression now waits for the child to exit before reading its final bind-error diagnostic, which main prints after cleanup. The test still observes and sanitizes the cleanup receipt before exit, requires autonomous nonzero exit within 60 seconds, and checks the exact HTTP bind failure. No runtime behavior or test assertion is weakened.

Validation at head 6bd3d8e: two independent implementation reviews and an independent review of the test-only runtime fix passed. The complete Linux repository gate passed nightly formatting; all-target/all-feature Clippy with warnings denied; cargo build; cargo build --tests; and source .env.test && cargo test --all with isolated PostgreSQL, Redis and object storage. The full suite passed 2,243 tests with zero failures and two existing ignored tests across 18 targets (library: 2,022 passed). The log confirms all nine new DAG-validator tests, three bounded-memo tests, both real DB preparation/budget tests, and the occupied-port cleanup regression passed. Run: https://github.com/gitmono-dev/mega2/actions/runs/37269664139.