Harden namespace directory ownership and lifecycle cleanup

[raphaelfeitoza]

Stack

Depends on #31 (fix/namespace-path-traversal-89265). Review this PR against that branch, not main; merge #31 first.

This extracts directory-ownership and lifecycle hardening from #31; its minimal namespace-string traversal fix remains independently reviewable.

Summary

• Atomically reserve namespace directories and verify filesystem identity and exact-name ownership across create, fork, reset, load, and teardown.
• Replace configurator delete-by-path cleanup with store-coordinated, identity-checked cleanup. Quarantine incompatible replica logs and unsafe-to-reuse directories; count retained cancellation/replica quarantines.
• Coordinate operations with per-name locks rather than holding the global filesystem lock across remote work. Drain operations on bounded shutdown; distinguish internal default initialization from explicit creation.
• Fence stale metastore handles and queued writes with incarnation tokens, avoiding deleted namespace/shared-schema link resurrection. Recheck primary existence on cache misses.
• After backup confirmation, transfer destroy to a cancellation-independent worker. Persist a durable, atomically published per-name destroy intent before deleting SQLite metadata; on restart, reconcile metadata and the original directory/quarantine by filesystem identity before serving. Prevent reuse while the intent remains.
• Transfer reset to an independently draining worker and retain the old directory through replacement setup. A durable pending/committed reset record preserves the old config/inode; incomplete setup fails closed and startup either restores the old incarnation or finishes a committed reset. Coordinate linked-schema migration registration with reset to avoid invalid migration membership and scheduler exhaustion. Replica reset skips the primary-only migration jobs table.
• Add deterministic ownership, cancellation, SQL error, restart-reconciliation, migration-locking, default creation, replica reset and availability regressions.

Review and threat model

Independent correctness, security and read-only cross-file reviews found no remaining high/critical issue on final commit 744ca2f75f5cce3141b6400c62ee49fbc4cd1dbb within the trusted single-process/process-crash model. A Linux CI replica-reset regression on the preceding commit was fixed by 744ca2f75f and the same cluster test passed in the full rerun.

This is not a general atomic-filesystem or multi-writer security guarantee. Privileged external filesystem replacement is out of scope. Failed/incomplete resets and quarantined directories may require operator inspection; see docs/ADMIN_API.md. Sudden power-loss durability on Windows and device-level macOS F_FULLFSYNC are not claimed. Synchronous short filesystem operations under identity coordination avoid cancellation races but can block a Tokio worker on slow filesystems. Logical reopen tests do not substitute for actual SIGKILL/power-loss tests.

Validation

• cargo fmt --all -- --check, cargo check -p libsql-server --tests --offline, git diff --check: passed.
• Full Rust CI rerun on 744ca2f75f passed: both Run Tests jobs, Run Checks, unused-dependency/features check, Windows checks. The first run found a replica-only jobs table regression, fixed in this commit; the next run hit a DatabaseBusy failure in an unchanged concurrent-connection test, passed on retry; a subsequent full rerun passed.
• C and Go bindings checks passed on this commit.
• The separate Extensions Tests workflow fails before tests: runner Rust 1.85 versus transitive dependencies requiring Rust 1.88, also observed before this PR's latest changes. This is an existing CI/toolchain issue, not a test assertion.
• Native macOS server tests cannot link locally because of unresolved libsql_open_v3 / sqlite3_* symbols; Linux CI supplies runtime validation.