feat(storage): add SessionRepository contract

[MicroGery]

Summary

Implements phase 1 of #2370: the V1 Session checkpoint Manifest and object-store contracts, a deterministic in-memory SessionRepository conformance implementation, and CAS/idempotency race tests.

This PR defines the control-plane semantics and testable adapter boundary. It does not provide the production durable backend.

Contract

The design keeps two logical ports distinct:

• ImmutableObjectStore publishes and verifies immutable Bundle and Manifest bytes.
• SessionRepository owns Session identity bindings, opaque Repository revisions, head CAS, exact checkout, and commit/Fork idempotency semantics.

A visible Session head resolves through the V1 checkpoint envelope:

Session head
  -> immutable SessionCheckpointManifestV1
       -> compatibilityBundle: immutable verified #2369 Bundle

The compatibilityBundle retains the trusted #2369 archive digest, byte count, media type, and opaque object reference needed by later #1528 inspection and hydration.

Publication follows the required order:

1. publish and verify the compatibility Bundle;
2. canonically encode, publish, and verify the checkpoint Manifest;
3. create the Session or CAS-publish its head.

The in-memory conformance implementation covers create-if-absent, current and exact checkout, stale-writer rejection, concurrent commit retry reconciliation, independent source/target revision sequences, and fail-closed Manifest/Bundle integrity checks. A first Fork claim verifies that its explicit source revision is current and readable, rechecks after asynchronous validation, and persists the exact admitted source checkpoint plus its agent binding. This lets downstream Fork recovery use the originally admitted immutable references even after V1 head retention advances. The contract rejects a same-Session target, requires the target to retain the source agent binding, and rejects an inherited Activation identity on a Fork-created target. Fork retries use the already-admitted claim and therefore do not become invalid merely because the source later advances.

Non-goals and follow-up

• Implement the durable Repository and Immutable Object Store adapters.
• Add multi-process CAS, publication crash-recovery, and storage integration tests.
• Wire the Repository into Cloud Session Activation and Fork orchestration.
• Supply the retained Bundle digest to the full feat(storage): define and implement the Session Bundle filesystem codec #1528 hydration validation path in its owning integration work.

Refs #2370

Verification

• npm --workspace @maka/core run build
• npm --workspace @maka/storage run clean
• npm --workspace @maka/storage run build
• node --test packages/storage/dist/__tests__/session-repository.test.js — 18 passed
• npx biome check packages/storage/src/session-repository.ts packages/storage/src/__tests__/session-repository.test.ts
• GitHub Actions CI — pending for the current head

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Codex updated the SessionRepository contract, in-memory conformance implementation, tests, and PR description under human contributor ownership.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — it adds the internal Cloud Session checkpoint Manifest, immutable object publication, revision CAS, and Fork idempotency contract described above.

[hqhq1025]

Reviewed exact head 914b2fc1d00e98861ff84fe6f3911591a0527faa. This adds the V1 checkpoint Manifest/object-store contract plus the in-memory SessionRepository conformance implementation and tests. I found two correctness gaps in Fork recovery and target provenance; details are inline.

Validation: clean install; Core and Storage builds; Storage typecheck; focused SessionRepository tests (18/18); full Storage tests (1,114 passed, 10 skipped); Biome, ASF headers, and diff checks; hosted test green. A clean synthetic merge against current main 01fe14bd271c38d65e82ce58d1448b10a5844a46 passed the same focused and full Storage checks. The first local full-suite run exposed an unrelated Node 22.22.1 warning-sensitive child-process test; suppressing the runtime warning made that isolated test and both full suites pass.

Not assessed: the durable backend and multi-process semantics, which this PR explicitly leaves to follow-up.

Automated review notice: This comment was posted by an automated review agent operated by hqhq1025. It is not an independent human review and does not replace one.