feat(store): the fleet GC protocol — the sweep lease, SQL arbitration, pin reaping, and the fleet liveness verb (wave 6)

Grow the sweep and delete paths into their fleet forms under fleet: true
(ADR-008 §2, ADR-010 §2, ADR-012 §1/§5/§6.6/§6.7, ADR-013 §2); the
non-fleet forms are byte-unchanged.

- the sweep lease: sweep() composes the in-process single-flight flag
  with the SQL lease (sweep_lock_acquire on the fleet host), both held
  for the whole sweep and released on every exit path; contention at
  either domain aborts as SweeperLock report data, nothing deleted;
  the pool-sizing composition enforced (max_size >= 2 at the fleet
  constructors' entry — the lease holds one checkout; the body's
  clauses ride further checkouts)
- SQL-level delete arbitration: arbitrated_delete composes the two
  domains (in-process first — cheap, local; the engine's arbitrate
  second — fleet-authoritative) on the direct path (GcRefuse) and the
  window execution's re-arbitration; a foreign instance's un-expired
  pin row or liveness-table row refuses cross-instance
- the maintenance step: EngineFleetState::pin_reap (the seam as the
  named clause home) reaps exactly the expired pin rows, one statement
  on the postgres host, contract-tested, driven under the lease before
  the overdue execution
- the fleet liveness verb: register_liveness_source takes the
  fleet-shaped LivenessRegistration argument (ADR-012 §6.6's same-verb
  wording) — the named-table form registers the embedder's own table
  (schema-ownership rule holds; idempotent; deregistration composes
  via a new engine-side unregister), the in-process form stays legal
  (instance-local protection, documented); Registration carries its
  kind; the verb is fallible (the fleet form's error surface)
- the protect callback's fleet posture recorded: single-node-only,
  instance-local consult remains, materialization is the embedder's
  duty — no new machinery
- the fleet sweep body: protect consult → reap → execute overdue
  (two-domain re-arbitration, fall-through delete across both tiers)
  → mark (pool + in-process sources; SQL liveness consulted at
  arbitration time, never enumerated) → stage → release; counts exact
  relative to the schedule
- tests: lease contention/reaping between two instances, the
  foreign-row GcRefuse, the exact-set reap, the embedder-table
  protection + correction flow + malformed and fleet:false
  rejections, the two-instance exact-count shape, and the delay race
  in its fleet form; the wave-6 inert-machinery construction test
  rewritten to the now-live fleet semantics

Verification: cargo test (default) green; cargo test --features
postgres green server-less (skipping) and against pglo-poc :15432;
cargo test --all-features green; cargo clippy --all-targets -D
warnings green (default, postgres, all-features); cargo fmt --check
green; cargo doc --no-deps clean (postgres-feature warnings
unchanged at the pre-existing 21).

tests/conformance/rows.rs

@@ -44,8 +44,8 @@ use tokio::io::{AsyncRead, ReadBuf};
 
 use crate::factory::StoreFactory;
 use alkblobs::{
-    Algorithm, EntryMeta, Error, GcAbortCause, Key, LivenessSource, ProtectCallback, Store,
-    StoreMode, DEFAULT_DISPATCH_THRESHOLD,
+    Algorithm, EntryMeta, Error, GcAbortCause, Key, LivenessRegistration, LivenessSource,
+    ProtectCallback, Store, StoreMode, DEFAULT_DISPATCH_THRESHOLD,
 };
 
 /// The shared fixtures the rows run on — set-backed liveness sources,
@@ -64,7 +64,9 @@ pub(crate) struct SetSource {
 impl SetSource {
     pub(crate) fn register(store: &Store) -> Arc<SetSource> {
         let source = Arc::new(SetSource::default());
-        store.register_liveness_source(source.clone());
+        let _ = store.register_liveness_source(LivenessRegistration::InProcess(
+            Arc::clone(&source) as Arc<dyn LivenessSource>,
+        ));
         source
     }