Add private atomic native metadata lease handoff

[Ivanbeethoven]

Consume a committed native metadata preparation into an immutable catalog and one durable metadata lease in a single PostgreSQL transaction. Complete lease pins precede removal of the Prepare pins, and the preparation becomes CONSUMED with an immutable binding receipt. Rollback preserves the preparation; COMMIT errors return a typed uncertain outcome recoverable on the captured fresh primary.

The server binds a bounded canonical request digest, immutable bytes, full LIVE graph coverage, current policy generation and the database clock sampled after row locks. Consumed preparations cannot issue the old prepared receipt. Recovery reports an immutable event and the current lease state without repairing pins or granting read authority.

This private metadata-only primitive keeps binding/access construction closed until namespace identity, current policy and Git source-retention adapters exist. It enables no HTTP/body serving, physical collection or strict-publication capability; lease renew/release/read-pin lifecycle and preparation TTL remain separate slices.

Validation at final head abd8737c9037e19eac6aa774ca70358c2fbb6bd2:

• Complete Linux repository gates passed formatting, strict all-target/all-feature Clippy, both builds, isolated PostgreSQL/Redis/RustFS dependencies, all repository tests and cleanup.
• Full logs contain 18 test-target summaries: 2,289 passed, 0 failed, 2 pre-existing ignored. Actual successful results include seven lease PostgreSQL regressions, the descriptor binding unit test, all 15 installation PostgreSQL regressions, the migration sequence assertion and eight upstream filter tests.
• Two independent source reviews and local formatting/diff checks passed. The synchronized retention base is 3423b892ad454f832aa450625004b192de6a792e, including merged Bind native resolve projection traces to fixed publication source #43/Persist native metadata payloads and durable preparation receipts #44 and upstream main 40b0ef90eea49edbd6a423e78c1d6bb67e20610d through ordinary merges.

The final diff contains seven source/test/schema paths, with no planning documents, reports or credentials. The frozen performance workload was not dispatched.