feat(harness): project and reserve package GC candidates

[zhnt]

Problem and resulting behavior

Package lifecycle evidence can identify retention-eligible revisions, but it previously had no consolidated operator view or durable way to reserve a candidate against new references. This PR adds PLC9D1's internal, read-only GC projection and PLC9D2's dark reservation journal. Opted-in Desired State, Instance Runtime, and Package lifecycle writers use the same reservation guard before writing new references.

This is an incremental PLC9D slice, not executable artifact GC. There is no Product, CLI, RPC, Store deletion, or private-data deletion route.

Review focus

• Check the cross-process reservation lock and nested management/desired lock order, including replay and incomplete-tail repair.
• Check that new selections, activations, lease families, and pins are refused for an actively reserved revision while unrelated revisions and release paths remain available.
• A legacy or separately constructed writer without the injected guard can still write the Desired State journal. The regression test preserves that counterexample. D3 must bind all supported writers and exclude downgrade/legacy writers before any physical deletion is authorized.

The implementation boundaries and remaining gates are recorded in docs/internals/architecture/harness/plugin/plugin-lifecycle-plc9d1-contract.md and plugin-lifecycle-plc9d2-contract.md.

Validation

• make check-harness: 5191 passed, 66 skipped; Ruff and mypy passed.
• make check-docs-light: 6 passed.
• Focused adjacent Package lifecycle tests: 58 passed.
• Architecture dependency check and git diff --check passed.

Refs #509