WS-2868: harden host storage governance

[tangyuanjc]

Summary

• add restart-persistent, owner-scoped daemon admission pause/resume controls
• add minute-level storage guard with low-water enforcement, capacity sampling, and keyed Lark alerts
• add fail-closed transactional retention, dry-run GC gates, exact volume binding, and cron-to-FDA lineage proof
• add failure-injection and recovery coverage for archive integrity, admission ownership, legacy fallback, capacity readiness, and cron replay/overlap

Host safety state

• WS-2512 shadow observer is disabled; existing data remains intact
• production daemon was not restarted because active tasks remain
• retention stays archive_enabled=false and delete_source=false; code rejects source deletion until a producer-shared lease exists
• Cursor inventory was read-only; no workspace/history data was moved or deleted
• the 48–72 hour capacity verdict remains INCONCLUSIVE until the sample-density gate is satisfied

Verification

• 40 Python storage-governance tests
• go test ./internal/daemon -count=1
• focused daemon admission CLI tests
• full compiled cmd/multica test binary executed outside the managed Multica workspace
• Python compilation, JSON/plist validation, and git diff --check

The dynamic-workflow runners timed out after more than 15 minutes with an empty journal, so implementation continued through the workflow's documented main-thread fallback.

Closes WS-2868

[vercel]

Someone is attempting to deploy a commit to the IndexLabs Team on Vercel.

A member of the Team first needs to authorize it.