[KAVentures]

Problem

Historical evidence backfill is OFF by default, but its merged preview/confirm path previously verified the token and deleted the token/digest/window/expiry as separate SQLite writes. Two simultaneous authenticated confirmations could both pass validation and send the same historical evidence; an in-flight preview could also interleave with the field deletion.

Change

• Add a small generic, transactional SyncState.consume_if_matches primitive. SQLite DELETE ... WHERE value = ? succeeds exactly once across threads/processes and removes companion keys in the same transaction.
• Require atomic consent consumption after revalidating source-policy/evidence and before first upload, with an expiry recheck after potentially slow validation.
• Add actual two-thread racing confirmation test plus direct token-consumption concurrency test.
• Document single-use properties. No uploads in CI and no permission/default change.

Required acceptance

Run Python tests, Windows/macOS/Linux packages and privacy regressions. Leave OWG_ENABLE_HISTORY_BACKFILL OFF pending the full real Gateway/privacy/migration review; this PR does not enable historical uploads or close #226. Please do not auto-merge.