Persist session ACL in snapshots; restore on session_load (MN-REQ-06.16)

[chouswei]

Persist the session ACL in snapshots and restore it on session_load (MN-REQ-06.16, MN-VER-06-S14). SysML first.

Format: @SNAP format version 2 with a mandatory #@ACL: {json} line.

• A v1 snapshot loads with ACL off and prints @ACL: absent|off.
• A v2 snapshot missing the ACL line, or with a malformed ACL or bind, fails closed with bad_snapshot.

Load: session_load restores the enabled flag, the per-caller grants and the bind, for both file load and --keep-id.

Writes:

• All snapshot, manifest and report writes are atomic at 0600: mkstemp, fsync, os.replace.
• The bind lease is stored only as a sha256 digest and checked with hmac.compare_digest. Legacy raw leases are hashed on load.
• Before the first v2 write over an existing v1 snapshot, a one-time 0600 backup <file>.v1.bak is taken beside it. This covers the session, expire, checkpoint and upgrade writers. An existing backup is never overwritten, and there is no v1 dual-write.

Rollback / compatibility (by design):

• 0.19.23 and older refuse v2 snapshots loudly (bad_snapshot, or upgrade_snapshot_format for a v2 manifest).
• Rolling back to 0.19.23 means restoring the .v1.bak backups over the snapshots. That loses every write made after the upgrade.
• A session first created under v2 has no v1 backup and cannot be rolled back.
• See docs/operations/safe-upgrade.md.

Tests: full suite 586 passed, 1 skipped. Covered:

• ACL round trip
• v1 snapshot loads with ACL off
• v2 snapshot missing the ACL line fails
• a reader's write is refused after reload
• --keep-id reload
• 0600 modes and the lease digest
• v1 backup is taken once and never overwritten (including from checkpoint)
• malformed binds fail closed
• the upgrade rollback restore uses the atomic writer

No version bump or release here (0.19.24 separately).