Make IndexedMap publication transactional

[forhappy]

Summary

• require strict TransactionalStore support behind the sole engine.indexed_map(...) constructor
• route initialization, mutation, retention, maintenance, and bundle-import visibility transitions through one transactional canonical-root commit
• validate apply_if expectations inside every publication retry so a superseded conditional write cannot publish
• strengthen the transaction contract and shared IndexedMap adapter conformance suite
• serialize FileNodeStore manifest reads and writes across independently opened handles and processes with an OS file lock
• document the publication, retry, durability, and garbage-collection model

Root cause

The IndexedMap store abstraction previously required only Store + ManifestStore, so the coordinator published its canonical state with a direct root CAS even when the engine exposed strict multi-key transactions. In addition, apply_if checked its expected source version before calling the unconditional retrying mutation path. A concurrent writer could supersede that version between the check and publication, turning the conditional operation into a successful write.

FileNodeStore also coordinated manifests only with a mutex shared by cloned handles. Independently opened handles or separate processes could race root transactions.

Correctness model

Source data, secondary indexes, snapshot metadata, descriptors, retention, and pins remain immutable content-addressed objects selected by one canonical collection root. Candidate nodes may be written before commit, but they are unreachable. The strict transaction validates the previously loaded canonical root and advances that one root as the only visibility transition. Readers therefore observe the complete old state or complete new state. Conflicts retry from a fresh state; unreachable candidate nodes are safe for quiescent GC.

Keeping immutable node publication outside the transaction and committing one root preserves a constant-size transactional visibility boundary while supporting arbitrarily large source/index updates.

Impact

Existing callers continue to use only engine.indexed_map(...). Backends without strict transactions now fail closed with UnsupportedTransactions. Backends claiming support must provide linearizable root validation and atomic publication across all handles/processes sharing the store.

Validation

• cargo test — 500 unit tests, all integration tests, and 74 doc tests passed
• cargo clippy --all-targets -- -D warnings
• RUSTDOCFLAGS='-D warnings' cargo doc --no-deps
• ./scripts/check-secondary-index-cutover.sh
• IndexedMap adapter contracts passed for SQLite, redb, RocksDB, PGlite, and SlateDB
• deterministic regression for the superseded-apply_if race
• transaction failure/visibility and concurrent-writer tests
• repeated independent-FileNodeStore handle race