Reconcile admitted fragment inventory after restart - #316

After restart, a durable admission record can still say verified_observation even when its selected file has disappeared or changed. Add a bounded read-only reconciliation pass that rechecks every admitted request against explicit local file selections and caller-pinned manifest bindings.

The complete selection and aggregate logical read budget are validated before opening fragments. Each observation is verified, missing or unverified; the pass preserves all charges, records and files. Callback exceptions abort even when they resemble file errors. A changed ledger snapshot rejects the whole report. No partial report, scan of unknown files, deletion, repair, serving capability, publisher authority or future retention claim is introduced.

This is a recovery decision input for trusted local callers, not an owned retained store. File observations are sequential rather than an atomic filesystem snapshot. Existing trusted-directory and same-user limits apply. Logical reads are capped at 64 MiB over at most 192 admitted requests using the existing 32 KiB verifier; this is not a physical-I/O/CPU/RSS bound. Synchronous SQLite operations retain the existing busy timeout. No runtime dependencies or schema changes.

Validation includes restart with stale verified metadata plus missing/corrupt files, aggregate preflight before file I/O, symlink/FIFO/read failures, cancellation exception propagation, actual read accounting, and ledger changes from another connection and a separate process during a file read. Installed-package smoke reopens the ledger, verifies an existing file, removes the ephemeral fixture and confirms missing bytes remain charged. Native fast gate passed: 1,235 tests and 1,930 subtests, warning-free, including coverage, lint/format, strict typing and policy checks. Eight focused Python 3.11 tests also passed with ResourceWarning treated as an error. All 24 fresh hosted checks passed on this exact head, including build/install acceptance. Mutation is not run; existing coverage exclusions apply.

Keep this draft unmerged pending independent review. Durable ingestion/path ownership, writer fencing, orphan accounting, safe reclamation and repair remain future steps.

Exact review head: ff29892ea4ebb30cf6c51018fe52d4052ce86145; tree 8389ffbcfdae0b0943e4f9f55bf3bd497450ff31. Base: merged PR314 834023b1c45d223a9a6830cc58b4c60f06fc6675. The final tree was unchanged when aligning the feature commit with the squash-merged parent.