fix(project-registration): expose guarded update authority

[andrei-hasna]

Summary

• make the advertised project-registration guarded update capability callable on local and authenticated HTTP transports
• expose bounded path CAS, exact sanitized receipt lookup, and receipt-scoped rollback
• keep canonical paths request-only while returning stable IDs, revisions, digests, operation lineage, and response controls
• prepare the next unused patch version, @hasna/mementos@0.14.81, without publishing or installing it

Contract evidence

• RED: 16 pass / 3 fail; guarded route missing, guarded_update_route absent, HTTP client method undefined
• focused: 19 pass / 0 fail / 104 expect()
• adjacent CAS/schema: 9 pass / 0 fail / 197 expect()
• full: 2527 pass / 0 fail / 6588 expect()
• bun run typecheck: exit 0
• bun run build: exit 0
• staged secret scan: exit 0
• committed-diff secret scan and pre-push scan: exit 0

Safety and rollback

• stale revisions reject without clobbering
• byte-identical caller-key replay returns the immutable accepted pointer
• rollback accepts only the exact sanitized forward receipt and current result revision, then restores the exact prior row
• generic snapshot-bearing receipts stay inside Mementos; public wrapper responses contain no canonical path
• rollback for this PR is a normal revert of commit 11d501d29988409524e85f89af4081211b05c104

Tracking

• Mementos bug: 2078fa59-6d9e-40fd-b0d9-efdb211892a1
• Parent Projects bug: 787c70a3-1976-4bc5-818e-1ebba7562dea
• Fleet source task: 5a6e9172-25da-4e89-b1a4-55bd5ddfd9cc

No merge, tag, publish, install, or production mutation is included.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] GO — #73 @ 11d501d — lens: correctness+security+gates, reviewer Damon (1 of 1)

What I ran:

• bun install — exit 0. Setup only; no pass/fail count is emitted.
• bun run typecheck — exit 0. TypeScript emitted no pass/fail count.
• bun run test — exit 0. 2527 pass, 0 fail, 6588 expectations across 183 files.

What I read:

• Fresh base origin/main at a45d90c4a854aae12d57168ca31897213dbfca58 and head 11d501d29988409524e85f89af4081211b05c104.
• The complete diff for all 11 changed files, plus surrounding project-registration authority, HTTP client/server transport, authenticated server routing, project CAS/idempotency/receipt/rollback storage, response-bound handling, and SQLite/PostgreSQL adapter code.
• The private-path trust boundary from authenticated request through owned path handling, exact target/revision checks, immutable receipt lookup, sanitized public result, and receipt-scoped rollback.

Blocking P0/P1 findings: none.

Non-blocking follow-ups: none.