feat(storage): publish compact authenticated graph roots

[DecisionNerd]

Parent

Native sub-issue of #901. This issue must block #901 and does not expand its acceptance criteria.

Objective

Represent a generation's authoritative graph inventory as a compact authenticated content-addressed root so adding bounded immutable topology shards does not copy a generation-sized manifest or retain unreachable payloads.

Requirements

• Publish canonical graph payloads and a bounded-fanout authenticated manifest atomically with CURRENT.
• Reuse unchanged immutable objects without copying their bytes.
• Trace every live generation, checkpoint, and lease before bounded garbage collection.
• Preserve v1 migration, crash recovery, integrity, symlink rejection, and ordinary generation readers.
• Keep publication and GC work aggregate-observable and content-free.

Acceptance criteria

• Repeated append publications hash/write only changed descriptors and payloads within deterministic bounds.
• Interrupted publication leaves the prior generation authoritative; acknowledged publication survives reopen.
• GC never removes objects reachable from CURRENT, retained generations, checkpoints, or live leases.
• Corrupt, cyclic, oversized, traversal, duplicate-reference, and wrong-digest manifests fail closed.
• Storage tests and ordinary project reopen cover migration and the compact-root format.

Non-goals

Topology shard writing, UUID endpoint lookup, the public construction session, or Graph500 orchestration; those remain sibling #901 work.

[DecisionNerd]

Verified compact-manifest sizing and publication dependency (2026-08-24):

• PR feat(storage): publish compact authenticated graph roots #933 exact head 0f0ac5976ce6e4bfffc6ebed9df2aa0afa53fa8c still uses a fixed 64-nibble authenticated trie. Each logical graph file amplifies into roughly 62-65 manifest objects.
• The 100,000-file admission ceiling would imply about 6.05 million reachable manifest objects and 6.5 million construction attempts; that ceiling is not an S20 file-count forecast.
• The current first-generation S20 construction shape is expected to contain roughly 277 authoritative artifacts before final route/property adjustments. Even at that realistic inventory, the fixed trie produces about 17,351 reachable nodes and 18,006 install attempts. The exact count must come from final encoding evidence.
• A canonical authenticated Patricia/radix representation caps a nonempty inventory at 2F - 1 nodes (at most 553 for 277 files), while preserving content authentication and deterministic roots.

The root-correct change is a node-v2 compressed-prefix contract with canonical split/collapse behavior, deterministic insertion-order-independent roots, linear admission limits, and fail-closed rejection of malformed, mixed-version, cyclic, duplicate-reference, and noncanonical trees. Expanded graph/files-v1 migration must rebuild directly to Patricia v2; fixed-v1 node trees from this unmerged branch should not remain readable as ordinary production roots.

Required proof includes insertion permutations, long shared prefixes, divergence at first/last nibble, collision leaves, deletion collapse, corruption/limit cases, linear-scale object bounds, append/GC behavior, ordinary generation reopen, and portable lifecycle. ADR/storage docs must stop describing the manifest as fixed-depth.

This remains the first hard dependency for #932 publication: construction cannot assemble or publish the graph/files root until the compact authenticated representation is corrected. No Fly run should begin before that integration is locally proven.