fix(directory): bound revocation candidate state

[mj-deving]

What

• cap public, shape-valid revocation candidates at 16 per listing content hash during both chain scanning and persisted-state reconciliation;
• preserve every marker locator that already passed DACS-1 RB-4 verification, including across restart and stale scan-state recovery;
• bound inactive legacy candidate arrays and log every truncation event;
• document the operator-visible bound.

Why

Value-based marker discovery correctly avoids relying on an impossible StorageProgram-name prefix, but any chain participant can publish artifacts with a revocation-like shape. Invalid candidates cannot revoke a listing because publication still requires full RB-4 tuple, signer, hash, and signature verification. They could nevertheless grow per-listing scan state and repeated verification work without bound.

This change bounds that untrusted discovery state without weakening RB-4 validation or acceptance. Previously verified locators are the explicit exception because pruning must not make an already established revocation disappear.

Among unverified locators, current scan observations are retained before prior persisted candidates. Within each group, the first distinct locators in scan iteration order survive. A valid marker outside that 16-candidate window is not evaluated. Its publisher can anchor a fresh marker to re-enter discovery, but continued overflow can exclude that marker again. Once a marker passes RB-4, it is persisted in the protected set and later pruning cannot remove it.

Verification

At head c8c99409d5a3263d75b67f2c2a66133022ec890e:

• red regression before the fix: 20 distinct candidates remained for one listing hash; expected 16;
• bunx tsx --test test/verification.test.ts: 19 tests passed, including serialized restart and stale-state recovery;
• bun run test: 150 tests passed;
• bun run typecheck: passed;
• bun run build: passed; the local build emitted the expected warning because NEXT_PUBLIC_DIRECTORY_URL was intentionally unset.

No live Directory registration, deployment, chain anchor, or payment was performed.

Closes #67.