fix: harden component storage consistency

[Arbousier1]

Summary

• fail closed when component metadata exists without a full-Blob baseline, and reject non-byte-array inventory item tags instead of silently turning them into air
• return and adopt authoritative version/bitmap/generation metadata after same-session stale-version rejection so incremental saves recover on the next cycle
• freeze the actually collected component mask across entity-thread collection and async persistence, then clear dirty epochs only for rows that committed
• avoid inventing generation 1 when an authoritative in-memory cursor is unavailable
• force a full-Blob save whenever a configured save-trigger snapshot must be created

Why

The audit found several paths where component storage could silently ignore overlay data, repeatedly reject every future component save, persist Java default values after a config reload, acknowledge components that were never written, or bypass configured snapshots. The fixes preserve the existing fencing/session/version CAS and generation isolation model while making these edge cases fail closed or recover from authoritative database metadata.

Testing

• ./gradlew clean ci on Temurin 21: 216 tests plus MySQL/Testcontainers integration, shadow runtime, metadata, and Java 21 bytecode checks
• ./gradlew stressTest: login storm, cross-server contention, crash and fault-injection suite
• ./gradlew jmhBenchmark -Pjmh.include=ComponentDirtyMaskBenchmark
• Paper 1.21.11 compile/test compile on JDK 21 with Java 21 bytecode verification
• Paper 26.2.build.40-alpha compile/test compile on JDK 25 with Java 21 bytecode verification