Repair core foundations

[t1ktakdev]

This branch collects the foundation repairs that are not ready for main yet.

Completed so far:

• Windows and Linux CI quality gates.
• UTF-8-safe Timeline preview handling and reusable receipt persistence.
• Hardened content-addressed artifact storage for duplicate content, concurrent writers, integrity mismatches, symlink/reparse points, and temporary-file cleanup.
• Verification bookkeeping fixes so BEFORE/AFTER evaluation is check-scoped and recovery keeps verification/timeline state consistent.
• Repository metadata corrections.

Still required before merge:

• Finish Git Shadow Apply rollback behavior for real I/O failures, Linux overwrite semantics, and byte-safe Git path parsing.
• Strengthen database constraints and migrations around verification/evidence relationships.
• Finish missing Timeline/Evidence query APIs.
• Bring the branch up to date with main and run the complete Windows + Linux gate.

Keep this as a draft until those checks are complete.