feat(native): bind inactive persistent enrollment to root witnesses

[roodboi]

Persistent volume metadata can be reproduced after replacement. This inactive continuation saves an independent expected root witness in the durable pending owner before the original create/seed, verifies it before enrollment publication, and makes retained reads verify-only. Version 1 owners are not upgraded.

The native receipt 4 groundwork records a pinned guest tool installation before upload, preserves the original guest lease and operation deadline, and rechecks helper bytes and filesystem identity. The shared relay artifact reader now also requires current UID, one link, no group/world writes, and exact held-FD/path identity; dependency-free legacy graphs still read no artifact.

This is stacked on #233, #235, and #239. The new owned checkpoint is e1e6da928ea182e5695c8cd07caf3d8bdcb38073; those earlier source and failure records remain preserved.

Validation: 32 focused Rust tests, 23 protocol tests with 129 assertions, pinned TypeScript 5.9.3, changed-file Biome, privacy/diff/commit checks, runtime/guest Rustfmt, and default plus native-config-plan all-target Clippy with warnings denied passed. Independent source review covers the final tree and its clean union with current next e3b057b; all owning and incoming source paths are preserved. Initial compile/tool-setup/static failures were preserved and corrected within this scope.

Ordinary persistent startup remains refused before provider effects. All twelve exact-head CI jobs passed, including both real Ubuntu Linux xattr/FD private-filesystem tests in default and all-feature runtime rounds. Installed guest-helper transport/retirement and real Bun/SQLite retention remain unqualified. Whole-root/xattr copying and unsynchronized external writers are excluded; stock PostgreSQL remains a separate acceptance gate. Parsing a tool or owner receipt does not grant installation, enrollment, recovery, or deletion authority.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}