fix(sync): replicate malformed frontmatter losslessly by default

[callumalpass]

Summary

• Replicate readable malformed/null/scalar/list/duplicate-key frontmatter as exact opaque Markdown by default, with nonblocking structural diagnostics. No option, public TypeScript shape, protocol or state-format change.
• Preserve UTF-8 BOMs in the Node adapter and share Rust-compatible leading-fence/BOM projection parsing; retain invalid-UTF8/read-failure fences, normal conflicts, and receive-only divergence protection.
• Add byte-exact second-mirror, update/move/delete, both conflict choices, lost-reply restart, existing-checkpoint and stale-review regressions.

Evidence

• 196 SDK tests pass; all TypeScript workspaces typecheck; full recursive build passes.
• All non-desktop workspace tests pass, including server and editor.
• Portable/mobile check passes unchanged budgets (187,664 raw / 55,970 gzip bytes).
• Immutable SDK artifacts from 87e28391233c pass 96 Obsidian tests, build/mobile checks, and ten stricter adapter → reference authority → second-adapter round trips. The beta.91 control fails with seven YAML blockers; the candidate passes without a mode switch.

Still draft

Not published or deployed. Real Obsidian/hosted acceptance remains blocked by the previously reported LAB port ownership and disposable-vault prerequisites. Full desktop testing hit an Electron-installation failure; Rust checks cannot resolve the isolated workspace's missing sibling mdbase-rs. Details and consumer audit: docs/lossless-opaque-sync-acceptance.md.

Obsidian consumer preparation is in mdbase-dev/mdbase-obsidian#13; its released SDK pins remain unchanged pending an actual SDK release. Recovery PR mdbase-dev/mdbase-obsidian#12 remains separate.

[callumalpass]

Merge requested and PR entered the protected merge queue. The full merge-group qualification now fails in Previous release upgrade and OAuth and Historical v2 rollback and current provider recovery: v0.1.0-beta.101 is not the unique newest non-draft mdbase-connect GitHub release. This is the previous-release baseline guard, before current upgrade qualification can complete. Run: https://github.com/mdbase-dev/mdbase-connect/actions/runs/35091972053 . No protection bypass or release-metadata edits were made. The companion Obsidian PR mdbase-dev/mdbase-obsidian#13 has merged.

[callumalpass]

Refreshed only the ordinary upgrade predecessor to published beta.102, plus its pinned-identity tests and documentation. The repository-owned verify-release-bundle command verified publication run 35059159880, its full qualification lineage, Sigstore bundle, and all component signatures/attestations for ea65ae4. The live newest-release/annotated-tag guard and 59 upgrade/retained-v2 tests pass locally. Historical beta94/beta95 fixtures and all guard logic remain unchanged; no release or deployment was performed. Requeuing for full protected qualification.

[callumalpass]

Full queue run 35100191495 confirms both formerly blocked upgrade jobs now pass. Node, hosted-provider Rust, all system shards, macOS durability and Windows lifecycle also pass. The remaining failure is the unchanged Windows durability test registry::runtime_changes::tests::duplicate_bytes_remain_delete_create_and_public_cursor_replays_once: its existing five-second watcher wait expired (149 other tests passed). Retrying protected queue qualification once without modifying tests, deadlines or policies.