Define snapshot baseline commits at response delivery

[ben-ranford]

Outcome

Define bounded, delivery-aware baseline ownership for polling snapshots when a response is rejected by the output-size limit or fails to reach the client.

Review evidence

#94 (comment) at659870bc08fb81c269cffb436e08cdd4182181d2: the provider advances its baseline before Server.writeBounded may replace an oversized response with OutputLimit. A retry from the last client-known revision can then require a full snapshot.

Acceptance

• Reproduce full revision1, advance revision2, patch since1 with an action manifest and output limit that admits the fallback but rejects the snapshot; observe OutputLimit and retry since1 without actions.
• Specify whether successful delivery means encoding, enqueue, completed writer call, or acknowledgement. Define the boundary for writer failures and cancellation.
• Implement commit/rollback or bounded retained revisions with explicit concurrent request ordering and count/byte limits. Never roll back a later successful response to an older revision.
• Preserve host action authority, existing wire formats unless deliberately versioned, and full-snapshot recovery.
• Test successful polling, oversized full/patch replies, writer failure, cancellation and interleavings deterministically.

Scope

This is a new transactional delivery guarantee beyond #62's single provider baseline and full-snapshot recovery contract. Related: #105 concurrent baseline ownership and #101 subscription final delivery. Those do not define polling response commit semantics. Keep outside v1.1.0; document current full-snapshot recovery.