v1.7.0 persistence: durable store, singleton lease, and restart recovery

[jeffhuber]

Part of #1096.

Goal

Implement the durable single-tenant Operator store, singleton lease, idempotency ledger, and restart recovery defined by the frozen contract.

Scope

• Local durable store suitable for one Operator instance, with explicit schema version and migration/rollback behavior.
• Work items, observations, action intents, responses, reconciliation state, leases, budgets, owner actions, and terminal outcomes.
• Fencing tokens and compare-and-swap semantics for singleton ownership.
• Recovery after kill, restart, duplicate delivery, and uncertain provider/GitHub responses.
• Metadata-only Board/cloud projections.

Acceptance criteria

• Crash/restart tests at every mutation boundary do not duplicate work.
• A stale process cannot mutate after lease takeover.
• Uncertain actions reconcile before retry.
• Store upgrades and rollback are rehearsed against synthetic state.
• Retention, export, deletion, and redaction remain compatible with Code Mower's privacy boundary.

Code Mower delivery

One focused PR consuming the frozen fixtures, with deterministic failure-injection tests and independent exact-head review.