feat(workbench): restore checkpoints to COW forks

[wchwawa]

Summary

• add deterministic and idempotent Workbench restore-to-fork
• materialize checkpoint state as a writable COW fork while leaving the source unchanged
• persist restore operations, staging cleanup, restore_manifest.json, and paged durable base references
• retain borrowed objects after source deletion or snapshot retirement, then release them after destination deletion
• expose the typed workbench_restore MCP tool and structured restore errors
• refresh and fully restage client uploads after a stale object-GC claim
• check in the real RustFS and LingTai acceptance harness

Stack and scope

Depends on #402.

The Workbench restore call chain is LingTai Agent to Workbench MCP to MetadataClient to restore_subtree_path_to_fork_initialized to COW fork and restore manifest. It does not traverse nokv-fuse.

The diff from the PR base under crates/nokv-fuse is empty.

Explicitly excluded:

• operator rollback journal and in-place swap implementation
• global mutation fence
• FUSE writeback fencing or journal v3
• SubtreeReplaced and whole-mount invalidation
• remote WatchSubtree or ReplayWatch support
• FUSE object-GC restage or replay
• new FUSE invalidation metrics

The small baseline rollback change is only a safety boundary: it makes the raw inode API private and refuses rollback of fork-backed or borrowed targets so restore-to-fork base references cannot be corrupted. It adds no journal, fence, swap, or watch behavior.

Validation

• cargo test --workspace --no-fail-fast: passed
• cargo test --workspace --all-targets --no-run: passed
• cargo clippy --workspace --all-targets -- -D warnings: passed
• cargo fmt --all -- --check
• git diff --check
• checkpoint_restore_live_e2e_test.py: 12 passed
• LingTai capability and skill tests: 58 passed

Checked-in full live E2E with real RustFS, nokv serve, Workbench MCP, and current LingTai main: 11 of 11 passed.

Coverage includes:

• 200 concurrent renew calls with final expiry equal to the maximum promised expiry
• 200 deterministic short-lease renew and reaper races
• root mismatch checks before and after restart
• 101 current and historical entries paged at limit 7 without gaps or duplicates
• acknowledged metadata surviving SIGKILL
• restore-to-fork source preservation and deterministic operation id
• idempotent retry after restart
• destination readability after source deletion and snapshot retirement
• durable base-reference release and shared-object reclamation after destination deletion

[wchwawa]

Companion LingTai Workbench skill PR: Lingtai-AI/lingtai-kernel#857