feat: define native persistent data identity codec

[roodboi]

Persistent application data needs an identity that survives a change of compute generation. This adds an inactive, closed native owner codec whose binding contains the project namespace, logical storage, persistent owner, exact guest and local-volume policy. Enrolled records retain the original volume name, creation timestamp and directory device/inode. Run, plan and generation IDs are absent.

Pending intent can decode but cannot match an enrolled observation. The pure comparison refuses missing observations and changes to scope, owner, guest, policy, birth or directory. Unknown/duplicate/null fields, unsupported versions and malformed identities refuse with a fixed error. The byte bound applies before deserialization.

No runtime command consumes this codec. Parsing an enrolled assertion grants no durable enrollment or effect authority; there is no writer, promoter, adoption, creation, repair or deletion path. Guest rollover requires a separate future handoff. SQL retention, initializer behavior and full NC05 parity remain unqualified by this change.

Validation at 94e8a785:

• Independent source review passed; the committed patch exactly matches reviewed e70d845d.
• Six focused codec tests passed, including independent native run references, pending refusal, copied labels with a replacement birth, identity drift, strict wire handling and the input bound.
• Rust 1.97.1 format and default/all-feature, all-target Clippy with warnings denied passed. Cargo used locked offline dependencies, two jobs and disabled incremental compilation.
• Privacy, diff and Conventional Commit checks passed. All owned validator processes settled; no bundle, full test matrix or provider/engine effects were run.

Required exact-head hosted CI remains pending. This Draft establishes the data-only contract; durable enrollment and real persistent-database lifecycle acceptance are separate work.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[blacksmith-sh]

Found 1 test failure on Blacksmith runners:

Failure

Test	View Logs
native-config-process-policy (7.6s) — Native --profile must succeed/ native-config-process-policy (7.6s) — Native --profile must succeed	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[roodboi]

Superseded by #245, merged into next as d19cdd3. This exact branch head is an ancestor of the independently reviewed #245 head e1e6da9; its inactive persistent-storage groundwork is included in that cumulative change. Live guest delivery, retirement and ordinary persistent SQL remain open under NC05.