Persist bounded typed native projection observations

[Ivanbeethoven]

Native resolve timing currently reaches only filtered diagnostic traces, so commit-update measurements cannot verify that the returned snapshot has a durable, request-bound projection observation. Add a default-off, startup-only typed sink that reserves one of 64 preallocated 32 KiB buffers before serialization, fsyncs closed-shape records, atomically publishes status and preserves the first delivery, binding or drain error. Private anchored directories reject symlinks and incorrect ownership or modes; shutdown uses a bounded drain.

Resolve HTTP behavior and the existing trace remain compatible. These observations cover directory projection during resolve; they do not measure the entire commit publication pipeline.

Validation at final head e37870d7f0d1421466a6575c261367087dca0487:

• Complete Linux repository gates passed formatting, strict all-target/all-feature Clippy, both builds, isolated PostgreSQL/Redis/RustFS dependencies, all repository tests and cleanup.
• Full logs contain 18 test-target summaries: 2,274 passed, 0 failed, 2 pre-existing ignored. Actual successful results include all nine writer tests, five projection-observation tests, the READY resolve rejection/sticky-writer regression and eight upstream filter tests.
• Two independent source reviews passed; local formatting and diff checks passed. The synchronized base is c2011416157c4292774a11a63ff3c0dea39b891f, with upstream main 40b0ef90eea49edbd6a423e78c1d6bb67e20610d incorporated through ordinary merges.

The final diff contains 13 product source/test paths, with no planning documents, reports or credentials. The frozen performance workload was not dispatched.