Serialize public relation mutation and batch append

[justinjoy]

Scope

This six-commit #2033 slice adds a caller-owned relation mutation set and moves public single-row append, batch append, and radix-sort wrappers to descriptor-first, canonical-owner admission. Locked append stages overlapping input before COW or growth can retire its source storage. Radix validates exact prepared-workspace provenance and performs no allocation or admission after preparation. Public mutation holds its gates through publication and preserves the existing root-with-live-alias refusal.

The branch is rebased onto current main, which contains the merged #2032 prerequisite and later consolidation safety fixes. All six original commits were replayed with one-for-one range-diff mappings; the one context-only mapping reflects the renamed append implementation. Rebase validation found one remaining consolidation caller using the canonical-only COW entry point; it now uses the documented temporary legacy bridge until the full consolidation migration lands.

This PR is a partial #2033 implementation. It does not close #2033 or #2034. Remaining #2033 work includes locked append/reserve/consolidation migration and removal of the transitional raw-writer bridge.

Binary size policy and baseline

Until a stable version is explicitly declared, the 5120-byte size allowance is informational. PR CI reports valid size overages as over-budget without failing; measurement, profile, provenance, and exact merge identity failures remain blocking. The event base owns the policy mode, so a candidate cannot downgrade an enforced base.

The reference baseline is reset to 428046 bytes from the exact PR #2037 head measurement. The verifier pins the prior GCC 13.3 run/job, measured merge, profile, job-log digest, and repair paths, then reproduces the profile and .text measurement. The updated reference records the measured PR head and does not imply a size reduction.

Validation

• Full Meson build completed (4,297 build steps; incremental rebuild after compatibility fix also passed).
• Full Meson suite: 416 passed, 14 skipped, 0 failed (430 total).
• consolidate_incremental_delta passed after the compatibility fix, including shared-view compaction and denied-scratch cases.
• Focused size tests passed: provenance, exact-merge comparison, 19 size-policy cases, and early-size-gate checks.
• Uncrustify checks and git diff --check passed.
• Exact-head CI run 37113479256 passed the GCC build, binary-size/provenance gate, full Meson suite, and policy checks. The comparison reproduced the pinned GCC 13.3 profile and 428046-byte head measurement. The Perf Suite also passed in run 37113479002. At the time this description was updated, sanitizer jobs, ARM build, and mbedTLS validation were still running. The local compiler is GCC 16 and does not match the pinned profile, so its size result is intentionally rejected.
• A prior interleaved benchmark on the pre-rebase candidate measured a +270–327 ns (+10.6–12.5%) fixed admission cost for stable 16-row insertion rounds; that result is informational and has not been repeated on this rebased head.

Dependencies and follow-up

#2032 is merged. #2033 remains open and p1-high in milestone 0.80.0; this PR contributes the mutation-set primitive and public append/radix migration needed for its remaining work. #2034 remains open until the locked-caller migration is complete. #2036 tracks separate batch-append fixed-overhead profiling.

Refs #2033, #2034, #2036.

[justinjoy]

After #2032 was replayed onto merged main 1942863, an isolated replay of this PR preserved all six patch IDs and nine feature-file blobs. The exact GCC 13.3 release/TRACE synthetic merge measured base 420,564 B and candidate 426,644 B with matching canonical profiles. The authenticated baseline is 419,135 B and cap is 424,255 B, so this candidate is 2,389 B over. The replay was not pushed; this PR remains at its old head and is draft while the size blocker is resolved. No older-head green CI result authorizes this new topology.

[justinjoy]

Read-only size feasibility update for the #2032-based stack (no PR branch change):

• The six-commit replay remains blocked: exact GCC 13 synthetic merge measured 426,644 B against the 424,255 B cap (+2,389 B).
• The existing first two dependency-ordered commits, 82e3a9ec and 273b1883, have exact parent chain from Prepare relation cohorts and serialize shared-view rebind (#1965 prerequisite) #2032 head 0ba1d586. Their synthetic merge adebad1e with ordered parents 0ba1d586 / 273b1883 measured 424,017 B with the canonical profile, leaving 238 B.
• Focused native 9/9, ASan/UBSan 5/5, POSIX TSan 5/5, ABI 97 pass/2 skip/0 fail; independent read-only review confirmed the identities and measurement. This used the preserved exact Prepare relation cohorts and serialize shared-view rebind (#1965 prerequisite) #2032 base result rather than rebuilding that base, and did not run hosted CI or perf.
• This supports considering a separate two-commit prerequisite PR after Prepare relation cohorts and serialize shared-view rebind (#1965 prerequisite) #2032 is ready. The current six-commit PR remains draft and over the cap; append/radix follow-ups require their own size reductions and review. No baseline reset is justified.