Reuse verified .shift identity across save and reopen

[kostyafarber]

Problem

Opening and saving a large .shift package fingerprints the complete package more than once at adjacent ownership boundaries. This preserves correctness but repeats expensive work after an identity has already been verified.

Measured with a Source Han package containing 65,535 glyphs:

• package size: 1,667,179,802 bytes (1.6 GiB)
• reopen inspect-package: 7,380.901 ms
• working-store resume: 936.041 ms
• second source_identity_snapshot during resume-for-source: 7,216.803 ms
• warm complete Grid residency after renderer connection: 1,067 ms

About 14.6 seconds of reopen time was package fingerprinting. The second ~7.2-second pass is redundant.

Save As has the same ownership mismatch: FontWorkspace::save_as computes and stores the new package identity, then WorkspaceHost immediately calls inspectPackage and fingerprints the newly written file again.

Expected invariant

A package identity verified or produced at one boundary is handed to the next boundary as authoritative data. Resume, relink, and Save As publication must not reread unchanged package contents merely to reconstruct the same identity.

This must not weaken external-change, moved-package, dirty-draft, divergence, or save-conflict behavior established by #139.

Scope

• Reuse the identity produced by the initial package inspection when resuming or relinking a retained working document.
• Reuse the identity produced during Save As when publishing the new package binding.
• Preserve package ID, canonical path, fingerprint, file identity, size, and mtime information required by later conflict checks.
• Record before/after phase measurements using the 65,535-glyph Source Han package.
• Update the package/workspace architecture documentation.

Acceptance criteria

• Normal reopen performs one complete package fingerprint, not two.
• Save As does not immediately fingerprint the package a second time.
• Exact-path resume, moved-package relink, clean divergence replacement, dirty divergence orphaning, and save conflict behavior remain correct under real bridge/SQLite tests.
• Existing .shift packages remain compatible.
• The measured Source Han reopen removes approximately one 7.2-second fingerprint pass before renderer startup.

Non-goals

• Changing .shift ZIP compression; track that independently.
• Replacing the remaining authoritative fingerprint with metadata-only validation.
• Changing Grid atlas residency or cache policy.

Related: #139, #154, PR #172.

[kostyafarber]

Planning update (2026-08-02): keep this issue separate, but defer implementation until the native .shift physical boundary is settled. Direct TTF/VF preview (#143) never enters package fingerprinting. The measured duplicate hash remains valid for the current ZIP path; avoid optimizing a path that the native document cutover may remove.