[piroyoung]

Summary

• add the only RecoveryRequiredDatabase -> LiveDatabase gate and retain the exact recovery-complete transaction owner
• compose filesystem and memory opens through generation-aware checkpoint selection, absent-checkpoint bootstrap, replay/repair, transaction restoration, restart completion, and WAL retention analysis
• retain one exact CompatibilityContext, all database/child owners, and every failure-stage owner without automatic WAL reclamation or fallback from rejected checkpoints
• add ADR 0066, dependency-graph enforcement, compile-fail coverage, exhaustive recovery-stage failure tests, all-lock contention tests, unpublished-candidate rejection, nonempty selected replay, and child-process crash/reopen coverage

Validation

• cargo fmt --all -- --check
• cargo test --workspace --all-features --locked
• cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
• cargo run --locked -p ntsql-architecture-check
• cargo run --locked -p ntsql-contract --bin ntsql-governance -- fixtures
• cargo run --locked -p ntsql-contract --bin ntsql-governance -- provenance-offline
• cargo run --locked -p ntsql-contract --bin ntsql-governance -- provenance-online
• git diff --check

Closes #185
Refs #180