MVP+10 VACUUM

Purpose

Implement ADR-0009's offline verified rebuild without weakening writer, recovery, generation, or encrypted-protector guarantees.

[x] Admit Unix rename() plus containing-directory fsync() as the initial atomic replacement and durability mechanism.
[x] Record why documented Windows replacement mechanisms do not yet establish the required old-or-new and durable-publication contract.
[x] Implement the Unix publication helper and its pre/post-publication failure classification.
[x] Refuse Windows and other unsupported targets before checkpointing, creating staging artifacts, or mutating the source.
[ ] Prove same-directory replacement, source-old-or-new interruption states, and parent-directory durability behavior.

[x] Add a private guarded source-open/checkpoint path that consumes or borrows an already acquired WriterGuard.
[x] Retain the source sidecar gate across source close, staging verification, atomic replacement, and directory synchronization.
[x] Prove a competing writer receives FileBusy throughout the operation.

[x] Capture format, active crypto material, protector slots, and committed generation through a private typed rebuild context.
[x] Create a sibling staging database with the preserved context and fresh page nonces/authentication.
[x] Copy every live logical key/value pair in bounded transactions while preserving generation monotonicity.
[x] Reject invalid source structure before creating staging artifacts.
[x] Reject insufficient staging space explicitly.

[x] Compare source and staging logical counts/digests without exposing values.
[x] Require complete structured verification and no staging WAL.
[x] Atomically replace the source; never replace the writer sidecar.
[x] Return a typed report with byte/page/count observations and durability confirmation.

[x] Inject failures before checkpoint, during copy, during verification, at replacement, and during directory synchronization.
[x] Prove pre-publication failures retain the old source and clean recognized staging files.
[x] Prove post-publication uncertainty never restores an older source.
[x] Cover unencrypted and every supported protector unlock path.
[x] Run formatting, strict clippy, all-target tests, and strict docs.
[x] Update ADR/AR history and advance MVP+10 to benchmark closure.

[x] GitHub Actions stable macOS arm64 at commit abdc241 passed formatting, strict Clippy, cargo test --workspace --all-targets, and documentation in CI run 33812169906, job 100836236880.
[x] Treat this as native Unix execution of the admitted publication path, not as Linux, filesystem-provider, crash-power-loss, or broad platform qualification evidence.