fix(storage): add retained manifest import gates

[fishmingyu]

Summary

Add the backend-neutral receipt, archive-size, and catalog identity gates needed before retained manifests can safely enter the storage control plane. This is a focused prerequisite layer and does not claim manifest import or ref publication is complete.

Changes

• Add an additive ReceiptVerifyingObjectStore capability and exact LocalCAS.verify_receipt validation without changing the existing ObjectStore runtime contract.
• Reject forged receipt and scalar subclasses before backend access while documenting the point-in-time, non-pinning lifetime.
• Expose a conservative physical view-bundle size gate for coordinators to run before object-store byte access.
• Include namespace and repository identity closure in SQLite snapshot summaries and verify complete snapshot identity reconstruction.
• Record the completed gates and the still-deferred non-forgeable retained bundle owner, manifest planner, CAS upload, and ref publication work.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Refactoring
• Performance improvement
• Tests

Testing

• Tests pass locally
• Added new tests for the changes

pytest -q test/storage --tb=short: 283 passed.

Pinned Black 24.8.0, isort 5.13.2, flake8 7.1.1 plus bugbear, py_compile, and git diff --check all pass for the changed surface.

Checklist

• My code follows the project style guidelines
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• My changes generate no new warnings
• Any dependent changes have been merged and published

Stacked on #605. Keep this PR in Draft until that dependency is merged or the stack is explicitly restacked and reverified.