feat(gc): the in-process GC protocol — pins, liveness, delete windows, sweep, direct delete

The gc-protocol task (ADR-005; abort-as-data per ADR-012 §1; non-SQL
inline window staging per ADR-012 §5) wired on the Store facade:

- src/gc.rs — GcHome + RegistryCore: one arbitration lock over per-key
  pin refcounts, in-flight delete markers, and the registered source
  lists; async pin minting (acquire) that blocks on in-flight deletes
  (ADR-005's re-put case (a) delete-then-recover without engine I/O
  under the lock); the ordered-step convert primitive (pin release +
  registration in one section); batch one-step release; the
  single-node sweep lease (the in-process analog of ADR-013 §2).
- src/facade.rs — Pin/Batch carry the registry back-reference and own
  their drop release (batch drop decrements every member in one
  ordered step); new public vocabulary LivenessSource, ProtectCallback,
  Registration, re-exported from lib.rs.
- src/store.rs — sweep() (single-flight → zero-source safe default →
  protect consult → mark over both tiers' list() union → arbitrate at
  delete time → ~100/batch commit → exact-count report or
  abort-as-data), direct delete() (existence probe → full protection
  set per ADR-012 §6.4 → GcRefuse/Missing/delete through the
  fall-through), and the registration/unregistration verbs.
- 16 new tests + the facade pin/batch shape test reworked on the wired
  machinery: exact counts across both tiers, abort shapes, dedup
  refcounts, batch drops, live-shared sources, the conversion ordered
  step sequentially and raced, sweep-vs-pinned-put (64 rounds, every
  schedule, byte-identical delete-then-recover), publish-after-mark,
  no-torn reads under a window, single-flight contention, and
  malformed-list sweeps as operational errors.
- tasks/gc-protocol.md — status completed; named design points recorded
  in Notes.

Verification: cargo test (default) 46 passed; --features mem and
--all-features 89 passed each; cargo clippy --all-targets -- -D
warnings (default and --all-features) clean; cargo fmt --check clean;
cargo doc --no-deps at the pre-existing baseline (no new warnings).

Cargo.toml

@@ -36,4 +36,7 @@ hex = "0.4"
 rusqlite = { version = "0.40", features = ["bundled"], optional = true }
 sha1 = "0.10"
 sha2 = "0.10"
-tokio-postgres = { version = "0.7", optional = true }
+tokio-postgres = { version = "0.7", optional = true }
+
+[dev-dependencies]
+tokio = { version = "1", default-features = false, features = ["rt-multi-thread"] }