Harden current raw shred ingest and add safe release path

[augustin-cheron]

Summary

• harden the current Nuremberg shred receiver shutdown/drain path and validate forwarded payloads
• add protocol-v2 NAS pull/source preflight, signed ACK recovery, protected ACK-WAL handling, and fail-closed retention checks
• keep the first candidate source trial non-deleting (/data:ro, GC disabled) and add a clone-only finite GC canary
• add exact same-host green/final source identities and a documented no-gap overlap rollout
• add a manual, SHA-only GHCR publisher for the reader, Hivezilla recorder/source, and status collector, returning immutable deployment digests
• update watcher/status handling and operational runbooks

Safety boundary

• this change does not deploy, restart, delete, or migrate live ingest data
• live candidate GC remains disabled; no steady-state candidate deletion is authorized
• the existing Nuremberg receiver/recorder continues running during review
• the deferred Helsinki host is not used or modified

Verification

• cargo fmt --all -- --check
• cargo check --locked -p hivezilla --all-targets
• full local suite: 342/342 passed
• Compose, workflow, ACK-WAL permissions/compaction, cross-UID writer/GC, payload validation, and negative mutation gates passed
• Linux image/runtime gate for commit 85115582b728eeac68a41583a0e885419befffc0: https://github.com/FernoLabs/blockzilla/actions/runs/30115983673
• final release-path Linux gate for this head: https://github.com/FernoLabs/blockzilla/actions/runs/30118283622

Rollout after approval

Current host-capacity gate is NO-GO for live blue+green overlap: Nuremberg has 4 vCPU
and about 13 GB free, while the measured raw rate is about 21 GB/hour per copy. Before any live
cutover, provide at least 6 vCPU (8 recommended) and approximately 45–50 GB free or a separate
green data volume. The current blue path remains healthy and unchanged.

1. Merge the reviewed manual publisher to the default branch.
2. Dispatch it from main with exact reviewed head SHA 1d33830b926cfe374205e0b18f16124a121d4762 and preserve the three returned digests.
3. Verify private GHCR pull authentication on Nuremberg.
4. Start isolated hivezilla-green, then a dual-target bridge receiver; require advancing durable cursors/ACKs and flat loss/drop deltas.
5. Move to the final receiver only after the overlap proves durable. Preserve the incumbent volumes read-only.

Live deletion/GC enablement is intentionally a later, separately reviewed gate.