P36b+P36c: WAL checkpoints + bucket-backed sc serve — P36 complete

[tonibergholm]

Summary

Completes P36 (spec: docs/superpowers/specs/2026-08-26-wal-bucket-backend-design.md; ADR-0046 As-built extended).

P36b — checkpoints + log-tail cold start. New walfmt::Checkpoint record (magic SCWC: folded branch tips + cumulative pack list, strict fail-closed decode). BucketTransport::refresh() now stops its parent-chain walk at manifest.checkpoint_seq, seeding refs and pack index from the checkpoint — a reader never needs the folded log entries (proven by a test that deletes them). Absent, seq-lying, or chain-bypassed checkpoints each fail closed with a typed error. After a successful commit CAS, update_ref opportunistically folds a checkpoint once the tail exceeds CHECKPOINT_INTERVAL = 64 — coordinator-free, best-effort by contract: a fold failure or lost CAS never fails the push (fault-injection tested), and a fold that would exceed the codec's MAX_LIST cap is skipped rather than writing a checkpoint no reader could decode.

P36c — bucket-backed sc serve. The wire serve loop is generalized behind a ServeTransport seam (local keeps its tempfile fast paths verbatim; bucket uses the Transport trait with RAII spill dirs under the serve home's .sc/tmp/). sc serve --stdio|--http <addr> --store sc+wal://…|sc+s3://… <serve-home> serves a bucket with tokens, TLS, read-only floors, and limits working unchanged; the serve home must be an initialized .sc/ (fail-closed on both paths). Instances are disposable: two instances over one bucket show strict consistency with zero propagation delay (library test), and the CLI test kills instance one and clones the pushed content through a freshly spawned instance two. Wire protocol unchanged (PROTOCOL_VERSION 4).

Docs: ADR-0046, CLAUDE.md (P36 row complete + serve-home boundary), ROADMAP (built entries removed; serve-side pack cache follow-on added; compaction entry notes it relieves the checkpoint cap), THREAT-MODEL (serve-home split).

Review process notes

Seven task-gated reviews plus a whole-branch final review (which caught a real cross-task Critical: the unbounded cumulative fold vs the decoder's MAX_LIST cap — fixed with a skip-fold guard + regression tests; and relocated bucket-serve spills from the system temp dir into the serve home per the spec's own posture).

Test plan

• cargo test --workspace: 772 passed, 0 failed
• cargo clippy --workspace --all-targets -- -D warnings: clean
• cargo fmt --all -- --check: clean
• sc demo --agents 4: zero residue confirmed