Store: v2 local store, feed and upload effects, change-log reader (DEV-1150 part C)

[adamski]

DEV-1150 part C: the v2 local store that the driver loop (part D) will run the core against. Stacked on #49 (transport), which is stacked on #48 (engine core). Merge in order: #48, #49, then this.

What's in it

• Core follow-ups: page upserts keep the envelope seq, and a forbidden scope leaves the core. The connect backoff never drops below 1 s: it uses equal jitter max(1 s, c/2·(1+r)), capped at 60 s. This is a requirement from the 2026-09-28 reconnect-storm incident.
• Migration 013 (additive). Store::open uses WAL, and every read-then-write runs in one BEGIN IMMEDIATE transaction. Identity is adopted once; after that a mismatch is identity_drift.
• Snapshots and apply_ops: each rule call's ops go in one transaction. Recover writes the full local content to recovered before the content is replaced.
• Local write API: create, update and delete. Outbox marker ids per document keep increasing across processes, so an app and a DAW can share one data directory.
• Feed effects: change pages, snapshot pages, the resync sweep and subscription drops.
• Upload effects: build, settle, server copy and server-deleted. Settle deletes only the covered rows.
• Change-log reader: read is the single per-tick entry point. It is woken by data_version, heartbeats when due, and reports DatabaseChanged when trimmed past.
• Never rebase onto an untrusted base:
  • After a snapshot, pending edits made on v2 go through the conflict path (the local copy is kept in recovered).
  • A doc with no shadow and pending edits takes the conflict path on every path.
  • A migrated shadow at seq 0 still rebases.
  • A randomised property test checks that no edit is lost or applied twice, and that another device's edit is never reverted. The tests were checked by deliberately reintroducing the bugs.

Testing

• cargo test -p replicant-client --lib: 362 passed. --test wire_contract_tests: 14 passed.
• No v1 files are changed.