Build the opaque store v2 foundation

[AndriGitDev]

Summary

• add a sealed v2 metadata record with a fresh database id, explicit schema version, and validated migration ledger
• derive database- and table-separated HMAC-SHA-256 equality indexes behind typed contact and capability APIs
• add versioned logical records, random message-row locators, and canonical database/schema/table/locator AEAD binding
• validate the exact physical schema and every row on open, including future/disagreeing schemas, invalid ledgers, wrong logical keys and versions, duplicate indexes, and row transplantation
• keep the destination behind an internal activation capability and make legacy Store entry points refuse it before executing legacy schema statements
• record only the implemented foundation status in ADR-0027, storage/threat documentation, and the release evidence ledger

Safety boundary

No existing user table is converted and no mixed-format store can open. This change does not implement the all-table logical mapping, backup/restore integration, sibling-file fsync and atomic replacement, rollback-copy lifecycle, history pagination, remnant reduction, or platform qualification. Those remain required before ADR-0027 can be accepted.

Validation

• cargo +stable fmt --all -- --check
• cargo +stable clippy --workspace --all-targets --all-features -- -D warnings
• cargo test -p kult-store --lib --all-features — 41 passed, including the v2 property checks
• cargo build -p kult-crypto -p kult-protocol --no-default-features
• python3 scripts/check-release-version.py
• python3 scripts/check-docs.py
• git diff --check
• CI run #202: the primary formatting, release/documentation, workspace Clippy, workspace tests, and both no_std build steps passed on the PR head