Integrate native Git publication and collaboration with resident owner routing

[forhappy]

Repository reads and generated writes still used SQL object/ref metadata removed by the packed-catalog cutover. This follow-up integrates native catalog reads and owner-fenced publication into HTTP/SSH pushes, checks, pull reviews, candidate preparation, and reviewed merges. Symbolic HEAD and the existing constant-size ref summary publish atomically with certified native roots.

Generated candidates now run under resident staging ownership. Concurrent observations join the frozen candidate intent; Git emits a non-thin pack of only request-private generated objects. Independent physical verification and private commit-semantic verification precede atomic candidate result/reserved-ref/catalog publication (operation 55, codec 1). Generated reviewed merges select the immutable Ready candidate, validate its native audit and reserved ref, and recheck the current pull revision, reviews, checks, branch policy, authorization and joint roots (operation 9, codec 8). The existing candidate and merge rows retain the permanent typed audit; exact registered command recovery preserves the original SDK receipt. No legacy object mirror is rebuilt.

Line-thread creation now binds the verified hunk anchor and complete editorial intent to native ref facts before the owner transaction rechecks the pull revision and current access (operation 56, codec 1). Remote Git/LFS HTTP streams go to the verified current resident owner, which independently authenticates the original credential; bodies stream through existing admission, with bounded forwarding and no automatic retry of consumed receive-pack bodies. Final catalog CAS denial now selects the same pre-frozen refusal from an authenticated two-command recovery bundle, retaining exact SDK identities, phase order, and receipts. Reused push UUIDs from a different actor return the existing HTTP 409 conflict.

Backup now traverses the authenticated native catalog/ref/input/outcome/audit/recovery graph from the pinned Cell snapshot. It pages SQL roots, uses bounded traversal and disk-admitted physical deduplication, copies original creating namespaces, and verifies source and destination parts. Closed command records retain selected permanent roots without demanding retired command bodies or impossible future refusals. LFS remains paged and verified. The cold residency test now compares authenticated table snapshots: all repository/product rows, staging intents and existing receipts remain exact, while serving pins/custody and runtime sequence/time may advance. This replaces a physical-root equality assertion incompatible with durable serving custody. All six repos restore and pass clone/fsck/LFS checks locally.

The production push pipeline also waits for the controller to restore Active/Bound after an input checkpoint, while preserving the original receipt independently; a gated regression reproduced the old receipt-before-readiness race for both object formats.

Cold fetches now use authenticated provider-part reads, a private sparse pack for native Git decoding, and streaming canonical verification into bounded service caches. Request workspaces materialize the selected structural history and Git filter candidates. Guessed wants remain gated by certified live-ref membership; the native reachable-want repeat check is relaxed only on those validated gateway paths. Both protocol versions, lazy blob wants, tree/type/nested-combine filters, and negative cache assertions pass locally. Size inspection uses a disposable workspace and preserves the candidate cache behavior within combined tree/type selection.

Late SSH access downgrade now returns the original per-ref failure report only for a known inactive terminal attempt with current access below write. It cannot publish or acknowledge success; uncertain mutations retain their recovery/error path. Backup counts are checked against the actual retained manifest inventory rather than a platform-dependent deduplicated count, with explicit LFS and orphan exclusion checks. Standalone fixtures now use leased resident servers instead of detached handles or retired ingestion commands. The atomic fixture covers 600 native objects in both formats; restart destroys the first owner's disk before cloning on a new node. No workflow or integration test target is disabled. Coverage mapping and source evidence are in docs/evidence/native-ci-fixture-migration-20261006.md and native-selective-ci-20261006.json.

Validation: the complete locked local workspace suite at 85abb77 passes: 758 server unit tests, 107 multi-server tests (9 existing ignored), both supporting crates, every standalone target, and doc tests. This includes contended HTTP clone, expiry and exact renewal, paused-pack discovery with unchanged two-second requests, the HTTP/SSH filter matrix and negative cache assertions, backup after original storage deletion, and SSH/SHA-256 recovery. All-target workspace Clippy with warnings denied, formatting, diff checks, and the server build pass. The Python harness passes in GitHub CI. Both complete GitHub workflows pass at 85abb77: formatting, all-target Clippy, the Python harness, the full locked Linux Rust suite (758 server unit tests and 111 multi-server tests), RustFS qualification, and the server build. Verified PR run: https://github.com/crabbuild/canopy/actions/runs/37426775956; push run: https://github.com/crabbuild/canopy/actions/runs/37426771454.

Long fetch/discovery preparation now uses the existing renewable serving-session path, with a fresh final authority check. A gated regression holds a provider read beyond the initial lease and requires two renewals of the same pin. Expiry metadata warms before its unchanged one-second lease; the renewal fixture uses one reachable native blob to isolate lease behavior. No lease duration, resource limit, or negative assertion is relaxed. Discovery streams fully peeled packed refs from certified metadata in bounded pages, checks tag-edge kinds, and uses an admitted atomic replacement; native Git still owns the wire protocol and requires no native pack body for ref listing.

Large-team capacity, final DDL/retention/collection, shared membership acceleration and full workload qualification remain incomplete. This PR is not release qualified.