fix: consolidate release hardening and torn-store refusal

[pathscale]

Summary

Consolidates the correctness and release-hardening work after PR #46:

• makes versioned row publication safe by default and serializes synchronous inserts with competing row mutations;
• fixes stale multimap-removal lookup, caps upsert backoff, and audits churn invariants;
• defers vacuum page reuse through the reader grace period and prevents overlapping page/link reclamation;
• consumes the published WorkTablesIndex =0.0.5 / data_bucket =0.5.2 dependency chain;
• bounds the unbounded vacuum soak test that produced the orphaned high-memory test processes; and
• implements the accepted Option B resolution for Define and test the 1.0 persistence durability and crash-recovery contract #41: persistence is explicitly best-effort, and torn/corrupt state is refused at load rather than exposed as live rows.

Issue #41 durability boundary

Existing persisted stores now receive a startup-only validation pass before a table is returned:

• archived rows and physical links are checked;
• row primary keys must match forward and reverse primary-index mappings;
• duplicate physical links are rejected;
• secondary-index entries and cardinality must match the loaded rows; and
• loader errors or panics caused by torn persisted pages are contained as the public PersistenceLoadError type.

The durability guarantee matrix and supported restore/rebuild procedure are documented in docs/persistence-durability.md and linked prominently from the README. This does not claim crash-atomic durability: SIGKILL or power loss may lose acknowledged writes, and WorkTable does not provide an in-place salvage path.

The validation is proportional to rows × indexes and runs only on existing-store startup. It adds no branch, lock, or scan to steady-state insert/select/update/delete paths.

Review notes / known boundary

• tests/worktable/update_in_place_unsized.rs::same_length_update_stays_in_place remains ignored and explicitly documents the known unsized-row in-place update performance blocker. This PR does not claim that blocker is resolved.
• The mutation-gate and vacuum concerns from the PR fix: concurrency correctness and release hardening #46 review have standing timeout/invariant tests; the detailed dispositions remain in docs/pr46-review-findings.md.
• Persistence remains best-effort until a journal, shadow-page, or generation-manifest design provides crash-atomic multi-file commits.

Verification

• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo test --workspace --all-targets
• cargo test --workspace --all-targets --all-features
• concurrent six-test torn-shutdown module, including deterministic row and secondary-index corruption cases

All commands pass locally on macOS ARM64.