Account for checkpoint and finalization buffer ownership

[chaoz23]

Summary

• add versioned deterministic owner accounting for retained shared-search state plus the bounded, non-recursive observability ledger, with exact current totals and simultaneous high-water marks
• add post-write checkpoint and report accounting receipts for logical materialization, streamed serialization/compression or reuse validation, configured capacity, and durable bytes without feeding those receipts back into stable IDs
• expose configured finalization reserve as unallocated headroom and carry the bounded owner model through JSON-stream and compact-machine projections with fail-closed relational validation

Compatibility and deliberate scope

This is a partial accounting slice under #216 and contributes component-byte attribution evidence toward #156, within parent #215. All three issues remain open.

• existing retention-v1 and observability-v1/v2 inputs remain readable; checkpoints that predate owner accounting reopen with historyComplete: false instead of invented peaks
• the checkpoint-ID algorithm and artifact/manifest formats are unchanged; newly emitted deterministic owner state is part of logical checkpoint content, while post-write receipts remain outside checkpoint/report payloads and IDs
• accounting is deterministic logical UTF-8/structural ownership, separate from observational V8 heap/RSS and from configured reserve capacity
• owner coverage remains incomplete: checkpoint reopen/decompression/string/parse ownership, report merge/enrichment graphs, process-tree memory, and every transient combined heap peak remain follow-up work
• this does not activate allocation, eviction, compaction, or stopping policy; change deterministic frontier order; publish a package release; or restart the marathon benchmark

Verification

• TypeScript build passed
• shared-search benchmark suite passed 36/36
• compact machine-output suite passed 14/14
• focused checkpoint publication/reuse, report creation/reuse, resource-reserve, CLI resume/JSON-stream, additive shared-goal, privacy, documentation, and package-dry-run gates passed
• independent adversarial review found no remaining merge-readiness blocker
• exact-head push run 32685086732 and pull-request run 32685139588 passed all 10 hosted jobs across Ubuntu, macOS, Windows, hosted-container, and promotion-smoke
• exact-head Intercept sensitivity calibration (one excluded warmup plus four alternating fresh-process pairs) reached the same 50,000-state/maxStates-only boundary and identical 297-ending/29-knot/0-error evidence in every arm; ratio-of-medians was −0.45% wall time and +4.69% peak RSS (paired medians −0.45%/+4.75%), passing the narrow ≤5% median gate. Two individual RSS pairs were +7.28% and +8.15%, so this is noisy narrow evidence, not a marathon or promotion claim

The ordinary local full-suite invocation exercised 341 tests but was not a clean gate on this host: one unchanged synthetic 100 ms child-startup assertion fails identically on clean main because Node startup is currently 130–170 ms, while production uses a 900,000 ms timeout; the other failure loaded stale generated output while the final source patch was still being rebuilt, and the exact rebuilt machine suite subsequently passed 14/14. The exact-head hosted standard suite is green on all three operating systems.

Related: #215, #216, #156