feat(rooms): add Secret Service generation anchors

[tcballard]

Summary

• add an opt-in Secret Service-backed NIP-29 room-state generation anchor
• make the anchor contract asynchronous so D-Bus operations do not block Tokio workers
• bind every keyring record to its schema version, daemon context, relay signing key, and monotonic generation
• reject locked or unavailable collections, duplicate items, malformed records, context/key mismatches, and generation rollback
• retain file anchors as the portable default and reject ignored directory overrides under Secret Service

Configuration

Set rooms.anchor_provider to secret-service. The default remains file. rooms.anchor_directory and omachatd --anchors are invalid with Secret Service rather than silently ignored.

Validation

• complete portable repository gate passed
• workspace tests and rustdoc excluding Linux-only omachat-mesh passed
• warning-as-error clippy passed
• relay29 black-box lifecycle and Rust capture replay passed: 20 accepted, 0 refused
• packaging and cargo deny --locked check passed
• release aggregate: 4,149,840 bytes / 10 MiB

The exact Linux workspace, including omachat-mesh, is delegated to the repository Ubuntu CI.