Add reviewed media library commands and recoverable picture creation

[ethanfel]

An open companion library can become stale while the native Carousel changes a folder or asset. Existing grouped imports, image variants and frame captures also lack a shared reviewed operation/receipt boundary. This change adds conditional library commands and stages media before one complete destination catalog commit.

• Folder, membership, order, metadata, duplicate and delete commands require the reviewed storage revision and native ownership. Receipts commit with the authoritative catalog and survive legacy writes; exact replay cannot repeat duplication or deletion.
• Cross-project previews identify source/target catalogs, media dependencies and destination folder/enabled intent. The native importer supplies tag, role, lyric and track semantics in a private store. Copies remap audio IDs and retain source/derived provenance.
• Image review uses native oriented geometry, crop/target limits and resampling. Variants freeze source bytes and invoke the existing derive/register methods in staging; the picture and parent/transform provenance publish together.
• Saved-frame capture validates the displayed checkpoint revision and raw/review video, branch, file confinement, SHA-256 identities and clip-local time. Native FFmpeg extraction and picture import retain numbered tags, destination folder and saved-clip/time provenance. The original capture endpoint remains compatible.
• Prepared media and exact requests survive restart. Operation locks serialize retries, storage CAS rejects stale publication, and committed receipts reconcile lost acknowledgements. Captures resume from the prepared image without re-extracting the source. Rejected publication removes only that operation's unreferenced media.
• Reviewed media uses consistent operation → ownership → catalog lock ordering. Admission checks ownership; preparation permits takeover, and a short ownership guard fences final media promotion/publication. All staged actions follow the same order.
• Public capabilities and pending-operation identities support conditional companion controls. Admission rejects before allocating directories at the shared retained-operation limit; committed receipts remain replayable. Legacy native clients retain their endpoints and semantics.

Validation uses CPU stubs and temporary projects/videos. Native command, store and real-route checks cover selected pixels/alpha/EXIF orientation, requested-time video colors, exact saved/review identities, groups/provenance, ownership takeover, missing/damaged media, stale reviews, one authoritative commit, preparation/promotion/catalog interruption, restart/exact replay and operation limits. The 16 legacy capture tests pass. SceneWeaver 0.5.15 passes its build, 37 frontend + 147 adapter/proxy tests and 144 browser cases, including compact capture-dialog inspection. No production project or GPU workflow was used.

This remains a draft targeting nightly. Representative production validation, isolated model upscale, global usage analysis and the remaining workflow-parity work stay open. API/persistence details are in docs/asset-library-commands.md, docs/asset-image-commands.md and docs/asset-capture-commands.md, including retained-operation limits, the primary/mirror boundary and best-effort staging cleanup.