Fix lake-wide capacity-scan topology race before v0.7.4

[PureSaber]

Root cause: capacity enforcement traversed the published hot lake while Curated, Normalized, Raw, Quarantine, or capture-epoch topology could remove paths concurrently. Independent review expanded the original same-revision finding to cross-identity and cross-subsystem races.\n\nFinal design on head 3c66327:\n- prune only exact transient relative paths; a legitimate Curated dataset named staging remains counted;\n- serialize published-tree replace/remove/unlink/rmdir with a lake-wide capacity topology lock;\n- capacity-check exact staged bytes and publish atomically under the same reentrant lock;\n- coordinate capture journal seal link/unlink and hot-lake immutable temporary cleanup with that protocol;\n- require explicit recovery_policy before a missing Normalized claim index may be rebuilt; normal reads never bypass capacity policy;\n- retain per-identity stage preparation outside the short global topology critical section.\n\nTests added:\n- same-revision Curated race;\n- published removal blocked by an active capacity scan;\n- capture epoch seal blocked by an active capacity scan;\n- dataset named staging cannot bypass quota;\n- missing claim-index recovery fails closed without explicit StoragePolicy and succeeds with it.\n\nLocal evidence:\n- focused P2 closure: 6 passed;\n- affected suite: 195 passed plus one known Windows PyArrow os._exit access-violation failure;\n- prior data-lake/Normalized suite: 137 passed,1 skipped;\n- ruff/format/diff checks pass;\n- 10,000-file capacity topology benchmark: max 0.363s per scan, well below the 60s lock timeout.\n\nRelease policy: merge only after this exact head passes Linux Python3.10/3.11/3.12 including coverage gates and a new independent read-only review reports P1=0,P2=0. Tag v0.7.4 only after merged-main CI passes.\n\nRollback: revert all PR commits; no schema or historical artifact migration is involved.