feat(cell-runtime): implement canonical LTX scaling plan

[forhappy]

Summary

Implements the canonical Cell LTX scaling track from crates/crab-cell-runtime/docs/canonical-ltx-scaling.md, with plans 004–017 kept self-contained and evidence-driven.

Included

• Architecture guard for crab-http-server -> crab-cell-runtime -> crab-ltx, including a pure coordination-kernel gate.
• Deterministic adversarial coordination simulation, replay corpus, broken-variant checks, and pinned TLC fast/negative/broad model checks.
• Resident local routing before catalog/control reads and bounded sparse hydration on the existing SQL worker path.
• Shared bounded native/bundle CellReplica publication paths, persistent verified directory cache, and fault-injection/cancellation cleanup coverage.
• Actor-owned idle eviction, hysteretic pressure shedding, paced movement budgets, persisted Queue/Workflow inventory protection, and one runtime/SQL/hydration/primitive ledger.
• Signed placement observations and deterministic weighted planning clamped by live runtime reservations.
• OS-process movement probes for one authority winner, exact-root preservation, owner fencing/recovery, lost-release reconciliation, receiver rollback, and membership-loss ordering.
• Schema-v3 qualification receipts, exact artifact binding, ten-row matrix manifests, path/symlink rejection, and fresh-process matrix verification.
• Plan 016/017 hard removal of the standalone Replica, ReplicaHead, standalone paged/VFS, and CompactionSchedule surfaces. Cell-scoped mechanics remain; old prefixes are never reinterpreted.
• Blob/Cron absolute-time windows anchored to mutation-issued time, plus Queue/Workflow durable recovery controls.

Verification

• crab-cell-runtime: full locked suite passes (214 library tests, actor/integration suites, with only explicitly ignored provider cases).
• crab-ltx: locked no-default and replica feature suites pass, including the canonical Cell root inventory qualification.
• Process-support actor suite passes once without retry masking; the membership-loss simulator regression passes.
• make -C crab architecture-check passes, including the standalone-LTX hard-cut guard.
• Matrix receipt CLI smoke passes in a fresh process; Clippy, formatting, docs validation, and git diff --check pass.
• PR checks: PR #216.

Remaining protected gates

The implementation does not fabricate release evidence. Protected provider/Kubernetes three-Pod fault receipts, matched Crab/Celld latency measurements, fleet-convergence/pressure receipts, and release-scale matrix rows still require their configured provider environments and exact tagged image. Local RustFS and multi-GiB runs are recorded as iteration evidence, not as substitutes for those protected gates.

[forhappy]

Follow-up pushed in d6684352d23 / cf8642a37fb / bda23353d24: active-Cell file descriptors are now part of the shared RAII ledger and eviction cost, surfaced via runtime stats and Prometheus gauges, with lifecycle/metrics assertions and a four-way concurrent reservation proof. Focused and full local gates remain green; external provider, multi-GiB, multi-process/Kubernetes, and standalone-contract decision gates remain intentionally open.

[forhappy]

CI follow-up 6850d4c94c6 fixes actionlint failures by moving runner.temp Cargo target paths from job-level env (invalid context) to step-level env. Local actionlint now passes; the workflow will re-run the model and contract gates.

[forhappy]

Follow-up f1d4f546727: coordination simulation movement release and release invariants now use the same ready_to_deactivate adapter-observation gate as production. Coordination simulator corpus (10 tests), docs validation, formatting, and diff checks pass.