Add durable changesets with snapshot previews and atomic approval

[tvanhens]

Agents can now prepare durable changesets that users inspect through the application's normal queries and UI, then approve atomically. Preparing a proposal leaves the live database unchanged; approval checks the reviewed revision, current authorization, and operation versions, and rejects stale proposals.

• Add changeset preparation, append, inspection, discard, and approval through the client and MCP, with invited reviewers and configurable approval requirements.
• Build previews on immutable database revisions with persisted composition and catalog identity, generic durable ownership, reader leases, and garbage-collection retention. This provides shared internal foundations for future snapshots and forks.
• Remove the operation side-effect capability and execute proposed operations against isolated transaction state. Prepare and read previews outside the live write queue.
• Add indexed, paginated proposal listings, scoped subscriptions, and alarm-driven expiry. Expose database views to React and demonstrate the complete review flow in Reef.
• Document the public APIs and behavior. This intentionally changes pre-release operation and view APIs; automatic proposal rebasing and public snapshot/fork APIs are outside this change.

Validation completed locally:

• Typecheck and package build passed.
• 1,746 unit tests, 188 browser tests, and 136 local integration tests passed.
• Reef browser flow passed: preview, reload, approval, concurrent-change rejection, discard, and agent token creation.
• Documentation checks and site build passed; git diff whitespace checks passed.

The existing Reef development stage rejected credentials before proposal review; the complete flow passed in a fresh isolated local stage. No authentication bypass was added. Cloudflare remote e2e was not run.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-11T16:45:36.620404Z	55cf29a	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

Docs preview destroyed

This PR is closed; its preview stage has been torn down.

[github-actions]

Reef preview: https://ramose-reef-web-pr-645-liuhcoanrhqgjjej.tvanhens.workers.dev

Deployed from 55cf29a as stage pr-645. Torn down when this PR closes.