feat(lattice): add durable provider request journal

[mgazza]

Summary

Adds the detached, default-off durable provider-request boundary required before any ranked provider executor can be registered.

• persists exact path, ownership, writer set, lease/fence, request digest and stable provider request ID before the first write
• records PREPARED then IN_FLIGHT durably and reconciles the same request ID after restart without resend
• permits fallback-safe NOT_APPLIED only with explicit no-effect proof; timeout, conflict, unavailable, UNKNOWN and persistence ambiguity never authorize another writer
• replays terminal evidence even after lease expiry and reconciles expired IN_FLIGHT/UNKNOWN before consulting the clock
• preserves APPLIED/NOT_APPLIED evidence on request-ID collisions and enforces immutable identity, exact revision increments and the legal phase graph
• uses a current-UID mode-0700 anchored parent plus current-UID, regular, singly-linked exact mode-0600 journal/lock/temp files with no-follow relative operations, atomic replace, fsync and exact readback

Safety boundary

This module is not registered in the provider fallback runtime. It contains no live provider executor, transport I/O, production path selection or feature enablement. Existing behavior is unchanged and the stack remains default-off.

Verification

• focused journal suite: 25/25 on Python 3.9 and Python 3.13
• wider provider/runtime/publication suites: 89/89 on Python 3.9 and 89/89 on Python 3.13
• Black, Ruff, py_compile, cspell and diff checks: clean
• independent re-review: APPROVE after fixes for expired recovery ordering, terminal collision immutability, legal transition enforcement and hardlink/ownership/mode defenses
• GitNexus staged scope: LOW, exactly two new files, 133 symbols, zero affected execution flows

Stacked on #4383.