[piroyoung]

Summary

• add a one-use domain permit and exact receipt for ClosePending -> Closed clean-manifest publication
• retain every database and transaction owner in terminal failure results, with explicit durable-state classification and no same-owner retry authority
• model selected, candidate, and synchronized manifests with all memory fault timings
• publish filesystem Manifest V2 through a locked candidate, candidate sync, atomic replacement, inode/byte verification, and parent-directory sync
• publish clean-close checkpoint evidence in a physically disjoint sibling slot without changing the recovery-selected checkpoint
• reject Clean manifests at the recovery-required acquisition boundary while keeping generic manifest observation available for the next clean-open phase
• record the boundary and ordering in ADR 0070

Validation

• cargo fmt --all -- --check
• cargo test --workspace --all-features --locked
• cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
• cargo run --locked -p ntsql-architecture-check
• cargo run --locked -p ntsql-contract --bin ntsql-governance -- fixtures
• cargo run --locked -p ntsql-contract --bin ntsql-governance -- provenance-offline
• cargo run --locked -p ntsql-contract --bin ntsql-governance -- provenance-online
• git diff --check

Refs #186
Refs #180