fix: recover legacy native filesystem device identities after reboot

[roodboi]

A physical macOS reboot can renumber a mounted filesystem while retained native disks and source directories keep their inodes. Strict ownership checks then block recovery. Add a read-only inspection and an explicitly opted-in, hash-selected legacy migration that atomically updates only the owner's disk/source device numbers after verifying offline ownership, closed disk handles and unchanged retained identities.

Normal startup keeps strict identity comparisons. Legacy receipts have no original volume UUID, and the migration explicitly reports that limitation. Prepared-base pools and pending updates refuse. Historical graph receipts remain unchanged; no provider starts and no alias is restored by the migration. A torn owner.pending is preserved and requires separate recovery. Held lock paths are checked against retained descriptors immediately before publication.

Validation at4b5bdff9:

• Nine macOS recovery regressions, including disk/source substitutions, stale selection, live/reused PID, held/replaced locks, open disk handles and pending updates.
• Full Rust default:932 passed,62 ignored; all features:1,018 passed,80 ignored. Formatting and strict Clippy pass in both configurations; privacy passes.
• Full signed native package build and integrity checks pass.
• Signed native inspection/migration succeeded on an actual retained stock application pool after the host reboot. Independent before/after checks confirmed only the three selected device fields changed; subsequent ordinary recovery restored the exact temporary HOME and reached recovered-unclean with provider absent. Historical graph receipt hashes remained unchanged.

Remaining gates: actual application boot, historical socket/graph retirement and data/browser readback. This metadata recovery does not establish whole-application acceptance, original volume continuity, or pending/prepared-base repair.

Release intent: fix for experimental native recovery. Tracks HACK-1210. Base next; currently stacked on #96 (missing temporary HOME recovery), which must land first. No prerelease publication.

[roodboi]

Superseded by merged #122. This PR’s source was incorporated through #122, squash commit cf4b6e9. Independent acceptance remains in Linear. Closing as superseded; branches and worktrees are retained.