feat(runtime): rebuild managed mutation settlement

[zhiiw]

Summary

• rebuild the M2.3b Runtime settlement boundary on the current M2.3a reservation branch
• require managed mutation admission before T1 and forbid post-T1 generic fallback
• keep the operation capability linear and revoke it at terminal settlement
• capture one bounded strict-JSON immutable Runtime-owned result snapshot
• adopt only an exact owner-committed durable response envelope

Primary invariant

After managed T1, Runtime has one linear operation authority and one immutable provider-result source. The workspace owner may return terminal proof, but cannot replace the live result. Every invalid, missing, detached, oversized, non-canonical, or mismatched settlement fail-stops without generic T2 or provider publication.

Scope

No Git candidate, filesystem mutation worker, ManagedWorkspaceOwner mutation lease, Desktop/CLI wiring, or M2.4 consumer is included. The historical M2.2 recovery inventory is deliberately not copied while M2.2 waits for Gitoxide.

Verification

• core/storage/runtime builds pass
• focused Runtime durable-boundary suite: 38/38
• M2.3a RuntimeEvent/authority/persistence/concurrency/crash command: 76/76 on the parent branch
• old/new delivery comparison retains the M2.3b implementation (range-diff semantic match)
• ASF source-header audit and git diff --check pass

中文说明

本 PR 重建 M2.3b Runtime settlement：managed T1 之后只有一个线性 operation capability 和一个 Runtime-owned immutable provider result。workspace owner 只能提交 terminal proof，不能替换 live result；任何缺失、越界、超限、非 strict JSON 或 durable envelope 不一致都 fail-stop，禁止 generic T2 fallback。

本 PR 不带 Git candidate、真实 mutation worker、Desktop/CLI 或 M2.4 consumer；旧 M2.2 recovery inventory 也不会在 Gitoxide 重建前被复制进来。当前 Runtime durable-boundary 38/38 通过，父分支 authority/crash 命令 76/76 通过。

[zhiiw]

Closed as an obsolete extraction/integration slice. The current delivery path is the merged Gitoxide foundation followed by #40 -> #41 -> #42. This PR remains available as design and implementation history.

中文说明

该 PR 属于旧 extraction/integration 栈，现已失去独立合并价值。当前交付路径是已合并的 Gitoxide 基础，然后依次审查 #40 → #41 → #42。这里继续保留设计、实现与审查历史。