Harden the v2 sync engine: list merge policies, conditional deletes, shadow from reply, returning users, clock skew

[adamski]

Hardening pass on the v2 sync engine, closing the design-review findings on lists, deletes, shadows, returning users and clock skew (DEV-1150).

• List merge policy per path (Atomic, Append default; Full reserved and refused). List conflicts are always whole-list; append on one side merges with same-length edits on the other; overlapping same-length edits, both-side appends, inserts/removes and repeated values conflict.
• Conditional deletes. A delete names the version it was made on (base_hash). A newer version supersedes a pending delete (DeleteSuperseded), keeping pre-delete edits as a kept copy (delete_superseded) only when edited. A no-shadow delete fetches the server copy first unless it is a never-sent create (incl. migrated docs). A delete the server refuses restores the server version (delete_refused copy when edited). A pending delete goes out behind parked rows; a refused delete parks itself.
• Shadow from the upload reply, with a divergence cap: after 3 corrective uploads a doc parks with SyncError{diverged}. Shared 59-case JSON Patch fixture with the server.
• Returning users: uploads are held until own's first changes answer. Refused uploads keep their sent marks.
• Clock skew: a clock_skew join is re-signed once with the server's clock; the offset is kept for later reconnects.

Tests: lib 570, wire 15; property model covers lists on both sides under both policies at 20k seeds.

Closes #3