feat(lattice): add atomic autoconfig materializer

[mgazza]

Summary

Add a default-off, unregistered atomic materializer for immutable compiled Lattice auto-config
plans.

The coordinator:

• durably wins a secret-free reservation before invoking the target;
• permits only the CAS winner to prepare a target operation;
• keeps candidate config and rollback pre-image target-owned behind an opaque handle;
• binds every operation to the publication cursor, projection digest, monotonic fence and exact
  operation identity;
• seals or invalidates target operations so late apply, rollback and stale-handle replay fail
  closed;
• recovers deterministically from RESERVED, PREPARED, APPLYING, APPLIED,
  ROLLING_BACK, ROLLED_BACK and UNKNOWN;
• advances same-digest publication cursors without performing a second target mutation;
• bounds durable counters, topology, values, provenance and semantic material before any external
  seam; and
• sanitizes target/storage failures without retaining secret values.

This PR adds no runtime registration, feature enablement, target implementation or production
write path.

Safety and review

GitNexus classifies the tranche as CRITICAL because it introduces the transactional
apply/rollback integrity seam (186 new symbols and 22 inferred flows). It has no existing live
production caller. Independent review covered CAS races, cross-restart overlap, replay/ABA
fencing, operation lookup integrity, partial target apply, rollback, terminal sealing and
value-free errors.

Validation

• 22/22 focused tests on Python 3.9
• 22/22 focused tests on Python 3.14
• 287/287 non-control Lattice tests on Python 3.9 after rebase onto feat(lattice): add Enphase inventory fragment #4358
• 287/287 non-control Lattice tests on Python 3.14 after rebase onto feat(lattice): add Enphase inventory fragment #4358
• Black, Ruff, CSpell and staged diff checks

Tracking

Part of Predictive-Cloud-Ltd/predbat-saas-infra#561 and the programme epic
Predictive-Cloud-Ltd/predbat-saas-infra#466.