feat(deletion): drain post-deletion access credentials

[dzdidi]

Summary

Part 4 of the graceful-deletion stack. Depends on Part 3.

Adds the final credential and final-read lifecycle required before guarded content can be removed.

The change:

• classifies credentials committed before the deletion cutoff;
• rejects late ordinary credential insertion;
• issues at most one final credential for each eligible frozen snapshot;
• persists encrypted final-credential winners for exact replay;
• creates bounded per-resource final-read state;
• claim-fences final credential issuance and final reads;
• blocks destructive phase advancement while access obligations remain;
• introduces one runtime master key with separate derived encryption domains.

The bearer credential is never persisted as plaintext. Retries replay the exact encrypted winner rather than generating a replacement credential.

Contract and risk impact

• Public API or SDK contract
• Persisted data or migration
• Authentication, authorization, identity, or secret handling
• Payment or entitlement behavior
• Runtime, deployment, or observability
• No contract/risk impact

Migration:

• 0016_content_lock_access_drains.sql

Time and lease validity are half-open: now < expires_at. Equality is expired.

PostgreSQL samples database time after obtaining the relevant row lock. The in-memory implementation samples its injected clock after obtaining the state fence.

Verification

The following commands were run successfully on the final combined stack:

• cargo fmt --all -- --check
• cargo test --workspace --all-targets --all-features
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• bash scripts/test-compose-bootstrap.sh
• git diff --check codex/bitkit-local-e2e-fixes..stack/graceful-deletion/05-execution

The final run included:

• locks-service library: 355 passed;
• deletion integration: 29 passed;
• PostgreSQL E2E: 12 passed;
• Compose bootstrap regression: passed.

This intermediate slice was not independently rerun after restacking; its isolated CI result should be recorded before merge.

Documentation

Updated:

• README.md
• docs/LOCAL_OPERATOR_DEMO.md
• docs/RUNTIME.md
• docs/plans/2026-08-10-graceful-content-lock-deletion.md
• examples/js-sdk/README.md

The documentation covers final credential issuance, final-read windows, runtime master-key configuration, and local Compose bootstrap behavior.

Checklist

• The change is focused and self-reviewed.
• Regression tests were added where practical.
• No credentials, identities, private content, payment material, or generated local state are included.
• Formatting and relevant tests/lints pass.