release: prepare beta79

[callumalpass]

Ships two fixes, one of which changes durable write-path behaviour.

Engine: unsettled-path commit race

Settlement runs after the commit lock is released, so a committed-but-unsettled transaction was invisible to the precondition check. Two writers could both take commit points against one baseline:

A: [lock] recheck ok                     -> phase=Committing -> [unlock]
B: [lock] recheck sees the OLD revision  -> phase=Committing -> [unlock]
A: [lock] settle -> path rewritten
B: [lock] settle -> matches neither before nor intended

B stranded its journal as NeedsManualRecovery, and recover_pending then failed on it at every later Collection::open. An ordinary lost write race could leave a collection unopenable until someone deleted the transaction directory by hand.

B is now rejected before taking a commit point, reporting concurrent_modification. (callumalpass/mdbase-rs#54, pinned via #291.)

Diagnostics: credential expiry never decoded

storage.credential_expires_at reported no expiry for every temporary credential — staging and lab read as permanent, days before they expire. The session token is standard base64 of jwt/<header>.<claims>.<signature>, not a bare JWT, so the claims were never read. None also means "permanent credential", so the broken case was indistinguishable from the healthy one. (#289.)

Also on main since beta.78

#290 adds pnpm check:workspace-pins, a developer preflight comparing sibling checkouts against pinned revisions. No runtime effect.

Operator note

A modest rise in concurrent_modification is expected and correct. Races that previously succeeded and then stranded now surface as conflicts. The signal worth investigating is a sustained rate against a small set of paths, not the aggregate change.

One behaviour change to know: a stale Committing journal now blocks commits to its paths until recovery settles it, where previously those commits proceeded and stranded. Visible and self-healing on reopen, versus silent and terminal — but new. Tracked in cloud-ops#205.

Verification

• mdbase-rs#54: 7/7 including three OSes and live PostgreSQL; its regression tests fail without the fix.
• Build against the engine fix for the unsettled-path commit race #291 (engine bump alone): 9/9 including hosted-provider, the job hosting the unified_cli race this fixes.
• Read the credential expiry from the token shape the minter emits #289 and Check sibling checkouts against what the workspace pins #290: 9/9 each on the fixed engine.
• node scripts/check-release-version.mjs — consistent at 0.1.0-beta.79.