Implement opaque asset, page, and deterministic bundle handles

[flyingrobots]

Outcome

Expose validated opaque handles for immutable assets, bounded pages, and deterministic structured bundles so applications never manage segment coordinates, catalog locations, or physical object identifiers.

Dependencies

• Implement retention namespace generation transitions #19 retention generations
• Implement precise verification reports and corruption refusal #20 precise verification reports
• Integrate bounded CDC deduplication with durable publication #82 durable ingestion
• ADR: define retention-derived lifecycle surfaces #85 lifecycle-surface ADR

Invariant impact

A handle must identify one completely validated immutable graph and must never imply durability, retention, publication, or application meaning that its accompanying receipt does not establish.

Acceptance criteria

• Asset handles bind exact BlobId, LayoutId, and admitted representation evidence.
• Page handles enforce explicit count-and-byte bounds and immutable exact bytes.
• Bundle handles use a canonical deterministic descriptor grammar with duplicate, order, depth, fanout, and aggregate-byte refusal.
• Traversal is streaming and bounded; named-member reads do not materialize unrelated members.
• Handles contain no physical paths, segment offsets, catalog generations, keys, or application labels.
• Retain and publish operations return generation-scoped evidence separate from the handle itself.
• Golden, mutation, corruption, graph-cycle, property, fuzz, and public-contract tests pass.
• Re-encoding or physical relocation preserves logical handles when their governed logical graph is unchanged.

Non-goals

• Mutable documents.
• Application-specific schemas or causal semantics.
• Using handles as access-control tokens.
• Hiding unsupported partial verification behind an opaque type.