protocol: implement the negotiated external-memory handoff extension

[SnowCheetos]

Context

#113 completed the classification and design direction for a compatible, negotiated external-memory extension. The v1 baseline remains correct: MemoryDomain::Shared is one provider-owned host-visible allocation and does not mean cross-provider import/export, cache transfer, or fence handoff.

Kore's emerging memory-fabric work and axiom's topology-aware scheduling need a portable protocol boundary only once a real import/export operation can preserve exact range authority and lifecycle. They must not reinterpret v1 Shared or advertise reserved capability semantics early.

Goal

Turn #113's completed design into an implementation-ready minor-version protocol program, with an executable conformance plan and an explicit baseline-copy fallback.

Required work

1. Allocate the reserved feature/capability and new opcode/object space under a new minor-version conformance directory. Preserve every v1 frame and refusal exactly when negotiation is absent.
2. Specify a transport-neutral export/import transfer slot: opaque native authority remains in the adapter/transport, while the protocol names object identity, exact subrange, permitted access, usage, and single-use/retirement state.
3. Define the full completion and visibility state machine: producer terminal success, release/cache transition, consumer acquire/import completion, consumer completion, release, cancellation, reset, loss, and revocation. Submission acceptance and elapsed time are not visibility proofs.
4. Define isolation and resource-accounting requirements for guests, providers, and backend pairs; include alignment, aliasing, mutable-writer exclusion, stale-object refusal, and diagnostics that distinguish direct handoff, imported sharing, device copy, host copy, and no route.
5. Update every compatible-extension artifact together: normative specification, wire ABI, Rust layouts/constants, layout manifest, vectors, requirements, scenarios, clean-room codec coverage, and backend/guest fault-path tests.

Acceptance

• A non-negotiating v1 peer exercises the existing explicit read/write path unchanged.
• Conformance covers successful handoff, unsupported pair, bad range/access, duplicate import, failure/cancel, device reset/loss, stale export, and teardown with outstanding work.
• No portable API or wire object contains a platform handle, physical address, raw IOVA, or an assumed coherency promise.
• At least one end-to-end integration keeps the direct path conditional on proven native mapping and otherwise reports an explicit, byte-counted copy fallback.

Relationship

Builds on the completed design in #113. This is a protocol implementation program, not authorization for Kore or axiom to claim external-memory support before negotiation and conformance land.