Add deterministic shared observability boundaries

[chaoz23]

Summary

• extend the nested shared-search observability ledger to schema v2 with deterministic sample sequences, canonical coalesced reasons, a 15-bit trigger mask, and an eight-count boundary-local semantic trigger tuple
• record category, frontier, cadence, and termination boundaries while keeping live process sampling/progress bounded to fixed cadence plus final termination
• add compaction-safe category timing, dry-gap, and per-million-transition facts without changing frontier order or search policy
• migrate observability-v1 and pre-ledger checkpoints without inventing missing history
• add a canonical, domain-separated SHA-256 self-check for emitted v2 checkpoint-observability state; it detects stale or accidental mutation but is integrity rather than authentication
• recursively whitelist the v2 compact machine projection and package the existing NDJSON progress contract

Integrity and compatibility

The surrounding report and shared-search checkpoint schemas remain v1; only nested shared observability is versioned to v2. Existing v1 types and read/migration paths remain supported.

The checkpoint self-check binds every fixed known nested ledger field after bounded exact-shape validation and canonical key ordering. A writer that can alter a checkpoint can also recompute this digest; persisted checkpoint payload and manifest digests remain the external corruption boundary.

Deliberate scope

• Issue [long-run] Add versioned retained-resource and semantic-yield interval telemetry #216 remains open; this is only the deterministic event-boundary/timing slice.
• checkpoint, epoch, and generic pressure are reserved reason values but are not emitted in this slice.
• Retained-owner accounting is still incomplete, including checkpoint/finalization buffers and several runtime owners.
• This adds no checkpoint-v2 component codec, owner budget, allocation/eviction/compaction policy, stopping policy, package release, or benchmark/promotion claim.
• The earlier observability-v1 calibration is historical evidence for its measured heads, not exact-head overhead evidence for this change. No benchmark was run here.

Verification

Exact local head: ee0a0c29387a85335b80bbaf296bf6de5743e7a5

• npm test: 337 total, 334 passed, 0 failed, 3 expected local socket skips
• focused shared-search/benchmark tests: 33/33
• focused compact machine-output tests: 13/13
• focused documentation guards: 2/2; all 4 progress JSON examples parse
• TypeScript build and git diff --check passed
• npm pack --dry-run --json: 116 entries; docs/progress-ndjson.md included
• independent adversarial review: clear after replaying sequence, compaction, migration, coordinated-tamper, canonicalization, privacy, and trust-boundary cases

Related: #215, #216