Add inactive shared-runtime mutation backend (port 1/n)

[callumalpass]

Adds a structural SdkWriteClient seam for typed-note creates, quick fixes and same-path type edits/creates. No setting or startup path enables it; today’s Connect remains the default. Holds/rejections propagate with no vault-write fallback. Old mirror/adoption profiles and in-flight operations block attachment; subsequent legacy operations and unported packs/migration/initialization/rename fail closed while attached.

Checks: typecheck/build, lint (zero warnings), 444 unit tests passed (one existing TODO), lossless mock/reference 10 exact round trips, mobile bundle check passed. Ten new tests. No real-runtime, desktop/mobile end-to-end or migration run. Activation/Worker/registry/daemon integration remains dependent on mdbase-next SDK host ABI and published receipts.

Coordinator merges; security review requested for path classification and runtime exclusivity guards.

[callumalpass]

security: no blocking findings — security-2, on head a5cc742, for this inactive seam only. Collection/path-class checks precede client mutation, rejected/held writes have no vault-write fallback, and old mirror/adoption/in-flight Connect work blocks attachment. No startup or user setting activates it. Activation remains a separate reviewed change: fence all asynchronous legacy mutation paths and callbacks, track backend writes through detach/rehome/shutdown, use real published receipts/CAS, and test path mapping plus runtime exclusivity on desktop/mobile. Source review only; reported tests were not rerun here.