feat(lattice): add whole config target

[mgazza]

Summary

• add a detached GeneratedOverlayWholeConfigTarget implementation for the atomic materializer
• treat the generated overlay as one complete, allowlisted target-owned document rather than a patch
• bind target path, allowlist, operation fence/digest/handle and journal revision exactly
• preserve an exact preimage, including file absence, for rollback
• provide target-wide process/thread exclusion, private anchored filesystem checks, atomic replace,
  file/directory fsync and exact readback
• classify crash or visibility ambiguity as durable UNKNOWN and prohibit blind overwrite/retry

Scope

This tranche is stacked on #4369.

It is deliberately detached and default-off. It does not register a runtime component,
construct or drain the compiler, edit COMPONENT_LIST, wire a provider, touch apps.yaml or
secrets.yaml, or write any live PredBat configuration. The only production file is the new
target implementation; current callers are tests.

Validation

• combined atomic materializer, durable-store and target matrix: 72/72 on Python 3.9
• combined atomic materializer, durable-store and target matrix: 72/72 on Python 3.14
• focused target suite: 44/44 per interpreter
• repository pre-commit: whitespace, EOF, Ruff, Black and CSpell pass
• git diff --cached --check
• GitNexus staged scope: HIGH, 134 symbols and 11 durability-sensitive internal flows; no
  production registration or caller
• final fresh independent review: APPROVE

Safety invariants

• the overlay is a canonical complete replacement with an explicit allowlist and protected path
• lock and data files must be private, single-link, current-owner regular files under an anchored
  non-symlink directory
• prepare/apply/rollback/seal/invalidate reserve enough journal revisions for the entire remaining
  lifecycle, including a later durable UNKNOWN downgrade
• every stable/terminal CAS is followed by exact visibility re-observation while the outer target
  lock remains held
• external mutation, read failure, replace ambiguity or crash cannot be reported as stale success
• exact MAX_SEQUENCE boundary tests prove zero target effect without headroom and safe sealing of
  UNKNOWN at the final revision
• diagnostics and exceptions do not expose projection values or opaque target payloads