Persist native metadata payloads and durable preparation receipts

[Ivanbeethoven]

Native metadata preparation previously left payload installation and durable recovery to callers. This change stores immutable, codec-verified page bytes and a complete canonical installation plan before finalizing a prepared retention graph. Repeating an operation returns the same preparation identity and receipt without adding graph references again.

The canonical plan binds the fixed native tree, scope, source/profile revisions, metadata root, unique pages and sizes, and unique edges. Finalization checks durable coverage and LIVE graph state under the existing schema-scoped retention barrier, then records graph references, prepare pins and the COMMITTED receipt in one transaction. Failed COMMIT returns a typed uncertain outcome. Recovery uses a fresh READ COMMITTED transaction on the captured primary storage and revalidates all bounded payload bytes, the canonical DAG and retained graph before returning a receipt; uncertainty never releases pins. Recovery may verify up to 64 MiB while holding the barrier; normal finalization validates bytes before its short graph transaction.

Stacked on #41 (feat/mst2-native-retention-dag). This is the bounded metadata-installation layer. Runtime/lease publication, content retention, prepare-to-lease handoff and physical collection require separate implementation.

Validation on current head 22e48a517caf27534b47a923b8cdd7a2772a6e3f:

• Full Repository gates run 37285103616 passed: nightly formatting, all-target/all-feature Clippy with warnings denied, product build, test build, and source .env.test && cargo test --all with isolated PostgreSQL, Redis and object storage.
• 18 test targets: 2,262 passed / 0 failed / 2 existing ignored. Library: 2,041 passed. All 53 Git CLI tests and the occupied-port cleanup regression passed.
• All 15 new PostgreSQL tests actually passed, including two-primary concurrent replay, fixed-manifest/payload conflicts, immutable-row enforcement, partial installation across reconnect, real subprocess SIGKILL after a partial durable installation, outer rollback, DELETING race, lost pins, same-length committed-payload corruption, captured-schema mismatch, barrier/query loss, and real TCP faults before COMMIT and after the server's COMMIT response.
• All 4 new canonical-plan tests passed. No new ignored tests were added. The existing ignored tests are test_dynamic_repos_push and the opt-in mst2_native_projection_medium_real_commit_leaf_update workload; this gate did not run the opt-in medium performance test.