feat: automate resumable CARAVAN preservation cycles

[chasebryan]

The first physical X200 preservation bring-up proved that the operator should not have to manually replay source-manifest, Git-bundle, audit, capsule-run, and receipt commands after every repair.

This adds scripts/caravan-preserve, a single resumable operator command for FCF-controlled preservation/origin hosts.

Key behavior:

• fast-forward-only self-update to origin/main, then re-exec the freshly updated preservation policy
• clean-worktree and single-run locking
• reuse of the existing dependency cargo and saved OCI recovery capsule by default
• source-only refresh when the expensive capsule is already complete
• automatic full preservation/capsule build only when required or explicitly requested
• narrow authentication of the first-X200 stale-receipt transition: only the four known source-refresh paths may differ from the old authenticated receipt
• no-network capsule recovery remains mandatory
• whole-mirror receipt is recreated and independently verified only after recovery PASS
• failures leave expensive cargo intact and tell the operator to run the same command again
• no git reset --hard, git clean, or recursive mirror deletion recovery behavior

Documentation and CARAVAN CI coverage are included. After this lands, the X200 operator path becomes simply:

scripts/caravan-preserve

instead of manually replaying the orchestration sequence after every repair.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.