feat(engines): the mem contract-reference engine — first real engine (wave 2)

- src/mem.rs: MemBackend implements Backend (seven methods + put_staged,
  name "mem") over Arc<parking_lot::Mutex<BTreeMap<..>>>; CAS
  first-writer-wins puts, materializing MemCursor body, degenerate
  in-memory MemStaging whose commit publishes via the same CAS clause
  and self-discards on failure; discard leaves zero residue.
- CAS re-put is dedup for both put forms; reads are no-ops on the
  virgin store; delete carries Missing; size is metadata-only.
- Eight in-module tests mirror the wave-1 double's assertions: method
  contract, list well-formedness, cursor body read contract + ADR-006
  range digest, empty-entry round-trip, staged happy path, and both
  hygiene forms (fail_commit test hook stands in for media failure).
- backend.rs: clamped promoted pub(crate) — the shared EOF-clamping
  arithmetic both mem cursor bodies compose (no per-engine duplicate).

Verification: cargo test --features mem (33+7 green); cargo test
(default) green; clippy --all-features --all-targets -D warnings green;
fmt --check green.

src/backend.rs

@@ -219,8 +219,10 @@ pub(crate) trait Backend: Send + Sync {
 
 /// Clamp a `[offset, offset + len)` request by `u64` read parameters into
 /// `usize` slice bounds against a body of `total` bytes — the shared
-/// EOF-clamping arithmetic of the cursor contract.
-fn clamped(offset: u64, len: u64, total: usize) -> (usize, usize) {
+/// EOF-clamping arithmetic of the cursor contract. Crate-internal: the
+/// engine cursor bodies behind [`Backend::Cursor`] compose this, so every
+/// engine's materializing and staging bodies clamp identically.
+pub(crate) fn clamped(offset: u64, len: u64, total: usize) -> (usize, usize) {
     let start = (offset as usize).min(total);
     let end = start.saturating_add(len as usize).min(total);
     (start, end)