Retire the "fold is a cache of NATS" model the store layer still assumed

[jaredLunde]

Why

slipstream's design is a bounded log: NATS keeps only the retained tail, and folds are the replicas of record. The store layer and its docs still assumed an older model, "NATS is the source of truth, the snapshot is a cache". Every cursor-expiry bug fixed in #21 was a component running on that model:

• the resync deleted whatever NATS no longer listed;
• a fold with data but no cursor was treated as empty;
• a restore assumed an artifact at C is the truth at C;
• on_applied's cursor was treated as durable.

This PR removes the remaining instances, so the code and docs state one model.

Behavior changes

• delete_with_version tombstones reach watchers, and so folds, as deletes. A tombstone is an empty-value write, and it now arrives as a Delete carrying its own revision. Previously the fold kept the key as present-but-empty while get/scan/keys and the repairs' key listings treated it as deleted, so the key-listing repair deleted it and its re-list put it straight back. entry() still exposes the raw tombstone for CAS callers (the export lease's takeover depends on it).
• watch_applied refuses ExpiryRepair::Restore/Auto without a store. A restore needs a fold to restore into; such a consumer silently held only NATS's retained view. ExpiryRepair::None remains the explicit way to accept that view.
• A warning when a cursor-less start with no repair armed re-lists a bucket that has already evicted current values.

Docs

• The store invariants are now fold + tail = truth (a cursor means every retained message at or below it is applied), cursor-after-apply, and replica of record.
• The durability rationale and recovery runbooks no longer say "delete the snapshot and replay NATS", which on a bounded log loses everything evicted. A lost or corrupt fold is rebuilt by importing an artifact.

New edge, pinned and documented, not fixed

The resume check is conservative: it sees only the stream's first retained revision. When every message after a node's cursor has been superseded (every key rewritten while the node was down), the cursor looks expired even though nothing was evicted. On an evicting bucket with no artifact ahead of the node, the watch fail-stops until the next export round. That's safe but unavailable, and a small hot bucket (heartbeat-style) hits it on a short restart.

tests/eviction.rs::supersession_only_restart_fail_stops_without_a_newer_artifact pins it against a live server. Telling supersession from eviction needs information the stream doesn't expose today (e.g. the cursor's message timestamp against max_age); that's a follow-up design.

Tests

• Live tombstone-as-delete through the plain watch and the multi-prefix resume consumer. A race in the first version was fixed (attach the resume consumer before anything supersedes its cursor); it then passed 100/100 runs under 4× parallel load.
• Store-less restore refused (unit).
• The supersession-only fail-stop, pinned live.

🤖 Generated with Claude Code

https://claude.ai/code/session_0152kQKDdP8XRhoeqisJYpWr