Complete adjacent ADR-0028 transitions

[AndriGitDev]

Summary

• expand the store contract to fifteen bounded transition plan kinds, adding profile bootstrap plus device control, confirmed link import, and convergence projection
• keep link ceremony secrets alive until their durable consequences commit, with restart recovery for a lost package return value
• seed selected device snapshots into convergence state, compact exact opaque event rows, and project group definitions, authorities, and tombstones deterministically
• impose the 4,094-group profile ceiling needed to keep revocation and maximum sync bundles inside one transaction
• remove obsolete bulk import/retention entry points and add a source guard against raw protocol-state setters
• extend failure/restart coverage across all plan kinds, maximum 504-copy group fan-out, partial delivery, duplicates, quotas, and presentation recovery
• update ADR-0028, the full transition inventory, stabilization index, and evidence ledger while retaining Proposed status

Verification

Current head:

• CI run 218 passed the full workspace formatting, lint, tests, MSRV 1.88, both no_std builds, dependency policy, Windows storage, desktop, Android core/app, iOS core/app, and all 22 fuzz targets at 60 seconds each
• container run 40 passed
• CI run 217 independently passed the same matrix on the implementation revision linked by the evidence ledger

Local checks also passed formatting, documentation links/claims, release-version alignment, diff hygiene, the complete transition and linked-device restart matrices, dependency policy, both no_std builds, all 22 full-budget fuzz targets, and the 100k- and 1m-message storage scale gates.

The local host denied multicast and Unix-domain socket creation and lacked desktop/Android/iOS prerequisites. CI runs 217 and 218 executed those workspace and cross-shell surfaces successfully.

Acceptance boundary

ADR-0028 remains Proposed. Linked-device authority replacement, first-contact admission and its pre-C2 alias bridge, leased relay custody, independent review, and supported-platform sudden-power-loss qualification remain P0 gaps.

Intentionally excluded P2 paths are live video, groups above 64 accounts, advanced moderation, high-bandwidth media, additional delay-tolerant carriers, cross-protocol federation, richer optional discovery/wake services, and later governance expansion.