fix(store): make object writes atomic and verifiable

[KumamuKuma]

Summary

• validate canonical SHA-256 object references and stream-verify stored blobs
• publish blobs from same-directory temporary files only after flush/fsync, then atomically replace the destination
• repair corrupt existing blobs and handle concurrent writers, including bounded Windows sharing-violation retries
• make doctor report invalid, missing, unreadable, and hash-mismatched referenced feature payloads, run artifacts, and proposal diffs

Why

ObjectStore.put previously wrote directly to the final digest path and treated any existing path as valid. An interrupted write could therefore leave a partial object that later puts silently accepted. Doctor only checked object existence, so syntactically valid tampered content could still be reported as healthy.

This keeps ordinary reads lightweight while making writes self-healing and giving doctor an explicit referenced-object integrity audit. Orphan objects are intentionally outside this PR's scope.

Verification

• Targeted object-store and doctor suite: 38 passed
• 50-round Windows concurrency stress: 128 puts per round across 32 threads
• Python 3.12 object-store smoke test passed
• Full suite: 550 passed, 5 skipped, 3 existing Windows baseline failures

The three remaining failures are the two replaced-external-symlink cases and the python -m source-resolution case already covered by #31.