fix: harden ingestion, recovery, and review qualification

[jmagar]

Cortex could lose or misrepresent ingestion evidence, release query capacity while cancelled database work was still running, and overwrite existing backup destinations. This PR addresses 48 repository-review findings and the additional issues found during Lavra and Vibin review, including pre-existing defects and stale CI contracts.

The changes bound ingestion and query memory, preserve file rotation and checkpoint recovery, make durable journal replay deterministic, keep source paths out of journal files, and report oversized records explicitly. Backup destinations must be new files; restores stage and validate all components before promotion. Authentication, graph redaction, subprocess ownership, transcript backfills, and browser request ordering are also corrected.

Qualification now attributes each mutation to a passing baseline and a specific failing behavioral test, isolates Cargo output, and terminates detached processes on cancellation. The branch incorporates main 3.16.2, updates release qualification pins and deprecated action runtimes, synchronizes packaged documentation, and brings standalone fixtures into the lint contract.

Validation:

• Complete merged workspace: 3,619 Rust tests passed, zero failed, four ignored.
• All-targets Clippy with warnings denied, formatting, workflow actionlint, fleet contracts, npm checks, and all three standalone fixture checks passed.
• Current foundation harness: 44 core checks passed, with supporting mutation, concurrency, browser-state, and failure-path suites.
• Real headless Chrome tested the actual web assets against a local authenticated fixture: successful Ask, wrong-token rejection, current network-failure rendering, and empty token storage.
• All nine real mutations were qualified using isolated builds during remediation. The updated driver also passes ten attribution, isolation, and cancellation regressions.
• Review passes covered correctness, tests, comments, errors, types, docs/config, simplification, architecture, security, performance, data integrity, and deployment. All confirmed findings are resolved.

No production deployment or Windows runtime execution was performed. Windows platform code was cross-compiled for metadata validation. Review coverage is bounded to the PR and traced surrounding code.