Sync: opaque Sedimentree histories and disposable-tree lifecycle

[lannbot]

Summary

• Carry non-Automerge histories through the existing signed Sedimentree/Subduction transport and storage. Add trusted Rust create/open/publish/read operations with explicit GroupSealed or CallerEncrypted modes, causal references, raw snapshots, peer discovery and notifications.
• Keep disposable-tree lifecycle in one metadata-only current us register per slot. Fresh replacement IDs, deterministic concurrent intent resolution, execution-time eligibility checks, control-first reconnect and retirement prevent stale content from resurrecting after winning control is learned.
• Integrate opaque Drive roundtrips and idempotent deletion of validated obsolete objects. Publish durable retiring control before cleanup, recheck in-flight uploads/imports, and retry cleanup across restart.
• Keep raw payloads out of Automerge and its compactor. Add focused concurrency, restore, stale-replica, envelope-binding, multi-parent, catalog-ordering and Drive race coverage. Independent review: LGTM.

Verification

• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets -- -D warnings
• cargo test --workspace (engine 6 unit + 48 integration; kernel 27 unit + 87 integration)
• cargo test -p polyvisor-engine -p polyvisor-kernel
• just wit
• cargo build --workspace --target wasm32-wasip2 --release
• just compose
• deno task build
• deno task check
• deno task test (36 passed)

CI supplies the existing real-Chromium E2E regression gate. No UI changes or new browser claims.

Scope and limits

Exploratory project with no users: document IDs now have a disjoint namespace; no migration layer. No public history WIT, backup identity/recovery implementation, or chat protocol/UI.

Cleanup concerns cooperating replicas/stores, not secure erasure. Offline replicas may retain/serve a former version until learning winning control. Keyhive's private, nonserialized content-key cache can remain until vault teardown; wrapper payload/head/ancestor cleanup and eligibility still apply. An upload completing during group adoption can remain orphaned in the old folder because adoption does not authorize deleting old-group data.

Automerge will be armed with merge commits and watched through CI.