Harden delta-shadow reconciliation and bundle verification

[gcp007-ops]

Summary

• preserve conflict-copy shards as readable delta shadows while keeping writes canonical
• make reconciliation receipts fail closed and advance state only after complete, atomic application
• stop full sweeps after the first incomplete shard and report the exact covered shard paths
• verify the semantic delta-shadow contract and source/installed bundle parity
• derive deployment verification identity from the current source manifest instead of a stale version literal
• keep append indices monotonic when the highest observed shard exists only as a conflict copy

Why

Conflict copies are part of the readable event history, but they must never become write targets. The original series established that contract across writer selection, reconciliation, receipts, and sync state. Review then found two remaining gaps:

1. installed-bundle verification was pinned to 5.14.2, so it rejected the current 5.16.2 source before parity could be checked;
2. append selection considered only the latest canonical shard, so a higher conflict-only sibling could make a new event land behind the reconciliation order or reset an all-conflict stream to shard 1.

The verifier now treats the source manifest as the version authority while still requiring the nexus plugin id and comparing installed identity before hashing. Append selection now uses the maximum index across the complete canonical-plus-conflict snapshot and creates a new canonical shard at max + 1 when necessary. Batch appends retain that complete snapshot and update the canonical cursor by full path.

Validation

• focused review regressions: 24/24 passing
• delta-shadow contract: 111/111 passing
• production build and Obsidian lint: passing
• git diff --check: passing
• full suite: 4282 passing, 29 skipped, with one preexisting failure in LocalCliInstaller (reports a namesake command that appears earlier on PATH); the same failure reproduces on the clean baseline and is unrelated to this series

Operational note

The branch is intentionally based on Nexus 5.16.2, matching the locally deployed patch target. Local deployment validation is tracked separately from merge/release.

Relates to #290.