Phase D: shard lazy load/flush/idle-unload + recovery/compaction

[brylie]

Implements workspace-sharding.md §6, building on Phase B's real per-shard
docs.

• Each shard unloads only when it has no authorized live connections,
  no active holds requiring it, and no unflushed state (extends
  workspace-store.ts's existing releaseContextIfIdle, unused since
  Phase 0 keeps its one workspace resident for the process lifetime).
• Documented recovery/compaction behavior on restart.
• Catalog stays small/resident enough to route and serve the sidebar
  without opening content shards.

Not in scope: the capacity benchmark re-run itself (Phase E) — this issue
implements the behavior §E measures.

Done when: an idle shard unloads and reloads correctly on next access, with
no data loss, verified by a restart/recovery test.

[brylie]

Set Priority: unset → P1: depends on #120's real per-shard Y.Docs existing before idle-unload/recovery has anything meaningful to unload. Sequenced after #121.

[brylie]

Blocked by #121 (Phase C): lazy-unload needs a live-connection/hold picture that's only accurate once the SSE feed (not just direct Yjs Awareness) is the browser's source of shard-liveness signals — building it against Phase B's routing alone would need reworking once Phase C lands.