[piroyoung]

Summary

• define ADR 0065's fixed create-candidate namespace, legal durable prefixes,
  child-first publication, and manifest-last durability barrier
• add crash-safe filesystem and deterministic memory create/retry coordinators
  with exact Created/AlreadyPublished ownership
• reject foreign, partial, aliased, non-initial, auxiliary, and out-of-order
  evidence without repair or cleanup
• complete a visible manifest's parent-directory durability barrier under all
  five locks before ordinary open can repair children or return recovery
  authority
• cover every publication boundary/timing pair, process exits, strict published
  retries, alternate memory owners, and manifest rename/sync recovery

Governance

• Provenance IDs: N/A (workspace-authored behavior only)
• Legal-review IDs: N/A
• Observer: N/A
• Specification reviewer: N/A
• Implementer: Copilot App
• No prohibited, confidential, copied, decompiled, or disassembled input was used.
• Every governed use is explicitly approved; pending is not approval.
• Observer and implementer are different people, or the change uses no externally derived behavior.
• Every new fixture is registered and its SHA-256 digest matches.
• Every dependency or CI action change includes source, license, digest, necessity, and review updates.
• Compatibility and trademark wording is limited to an approved, exact target claim.

Authenticated Legal-decision Review

• Legal-review records changed: N/A
• Proposed attestation IDs: N/A
• Referenced evidence pull requests: N/A
• No non-pending legal decision is introduced or changed.
• No pull-request author, automation, or repository administrator is represented as a qualified reviewer.

Validation

• cargo fmt --all -- --check
• cargo test --workspace --all-features --locked
• cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
• cargo run --locked -p ntsql-architecture-check
• cargo run --locked -p ntsql-contract --bin ntsql-governance -- fixtures
• cargo run --locked -p ntsql-contract --bin ntsql-governance -- provenance-offline
• cargo run --locked -p ntsql-contract --bin ntsql-governance -- provenance-online
• git diff --check

Closes #184
Refs #180