feat(store): the read paths — get/stat/read_range/has/list on the fall-through rule

- Public `(len, stream)` shape: `Store::get` returns
  `Option<(u64, Blob)>`; `Blob` (src/facade.rs) is a bounded, re-entrant
  windowed reader over the new crate-internal `AnyCursor` tier dispatch
  (mem materializing / local pread body families) — engine cursors
  never leak onto the surface; no chunk-iterator machinery.
- Verification-on-get pinned against ADR-006: kv-tier materialized
  reads whole-blob hash-check at get time (mismatch = Err(Verification),
  never a further fall-through); the large tier's streaming open is
  metadata + handle only (put-path verification + slice digests are its
  story); `read_range` carries slice digests only, on both tiers.
- `stat` rides the trait's `size` probe (never a content load) into
  `EntryMeta { len, algorithm }`; `has` is the pure existence probe;
  both fall through kv -> large like every key-addressed op (ADR-012
  §6.1) — consult order, not routing (never consults `tier_for`).
- Miss shapes enforced (the error module's behavioral note): both-tier
  misses are Ok(None) on get/stat, false on has, Err(Missing) on
  read_range; `src/error.rs` wave-2 deferral notes updated to enforced
  state.
- `list` decided Vec<Key>: materialized, sorted total-order union of
  both tiers (the sweep consumes the engines' enumeration directly);
  malformed pool bytes are fatal `Err(KeyInvalid)`, never a silent
  skip.
- `KeyInvalid` at the facade boundary: ops take opaque key bytes and
  convert via `Key::from_bytes` once (`boundary_key`); engines never
  see typed keys.
- Twelve read-path tests: virgin-store shapes per mode (dual-tier,
  mem-only, kv-only), the `(len, stream)` windows, fall-through,
  kv-first (decoy content in the large tier), both verification
  postures, list union/sort/pool-fatality, and malformed-key
  rejection on every op.

Task: tasks/store-read-paths.md (design points recorded in Notes for
the wave-2 review gate).

Verification: cargo test (default), cargo test --features mem, cargo
test --all-features green; cargo clippy --all-targets -- -D warnings
green in all three feature shapes; cargo fmt --check green; cargo doc
--no-deps clean beyond the pre-existing private-intra-doc-links class.

src/error.rs

@@ -26,9 +26,10 @@ pub enum Error {
     /// store-api.md §Error model).
     ///
     /// A miss on `get` and `stat` is a value, not an error — they
-    /// signal absence with `None` and never carry `Missing`
-    /// (behavioral enforcement lands with the facade in wave 2; this
-    /// doc comment states the contract here).
+    /// signal absence with `None` and never carry `Missing`. The
+    /// facade's read paths enforce this behaviorally: both-tier misses
+    /// resolve `Ok(None)` on get/stat (see `src/store.rs`'s read-path
+    /// tests; ADR-012 §6.5 ruling 5; store-api.md §Error model).
     #[error("key missing (read_range/delete: get/stat signal absence with None)")]
     Missing,
 
@@ -96,8 +97,9 @@ mod tests {
     /// both altitudes — the trait boundary's effective members plus
     /// the facade re-exposure with `GcRefuse` added, carried by doc
     /// comments and construction discipline rather than two types.
-    /// Facade behavioral enforcement (`get`/`stat` never carry
-    /// `Missing`; `Missing`/`KeyInvalid` exclusions) lands in wave 2.
+    /// Facade behavioral enforcement is in place on the read paths
+    /// (`get`/`stat` never carry `Missing` — their both-tier misses
+    /// are `Ok(None)`, pinned by the store.rs read-path tests).
     #[test]
     fn one_enum_both_altitudes() {
         let trait_effective: [Error; 4] = [
@@ -118,10 +120,10 @@ mod tests {
     }
 
     /// `get`/`stat` signal absence with `None` and never carry
-    /// `Missing` (ADR-012 §6.5 ruling 5; store-api.md §Error model).
-    /// Behavioral enforcement lands with the facade in wave 2; the
-    /// doc contract on [`Error::Missing`] is stated with this test as
-    /// its marker.
+    /// `Missing` (ADR-012 §6.5 ruling 5; store-api.md §Error model)
+    /// — enforced behaviorally by the facade's `get`/`stat` returning
+    /// `Option` (the store.rs read-path tests pin the both-tier-miss
+    /// shapes); this test is the doc contract's in-module marker.
     #[test]
     fn missing_is_exclusive_to_err_shaped_ops() {
         let absence_on_get: Option<String> = None;