feat(ts): publish imported type owners and provenance atomically

The separate payload and checked-semantic transfer operations (#494/#500) are prerequisites to #480/#487 but currently commit independently. A metadata failure must not leave a partially published imported owner in the destination. Real source-owner/node references also need a production registry rather than the test-only mapping used by the last compiled-source regression.

Add staged payload transfer with explicit commit/cancel, then a combined owner-scoped payload+metadata operation that rolls both back on failure. Keep existing canonical keys and enum identities intact. Add a source-owner registry that resolves declaration handles to actual HIR/text, gives distinct revisions distinct identities, rejects stale owners, and rolls back newly allocated provenance handles if owner import fails. Interned string capacity may remain caller-owned; no partial types, semantic record, or declaration mapping may be published.

Exercise cancellation, exhaustive allocation failures including failures after payload preparation, metadata key collisions, source invalidation/re-registration, and independent compiled declarations through the production APIs. Keep the graph, global, and imported-owner audits failing until actual program resolution uses these records correctly; no source concatenation, fake HIR nodes, or blind merging of owner-specific metadata.

Staged payload transfer now has explicit prepare/commit/cancel. The combined checked-transfer append prepares all semantic metadata before committing payloads. Fourteen focused transfer tests pass (including the module root): cancellation preserves existing keys/enum entries, exhaustive allocation failures restore every column, and failures deliberately triggered after numeric payload preparation leave no new type or key behind.

A production source-owner registry now replaces the test-only provenance mapper in the independently compiled owner regression. Each revision gets a fresh owner ID; declaration handles resolve to real source HIR, path, and text. Unregistering removes the borrowed source descriptor, and old handles cannot alias a replacement at the same path or memory address. New declaration mappings roll back with payload/metadata failures. String interning remains separately caller-owned.

The registry's initial full driver run passes 182 tests, including provenance allocation-failure rollback, invalid semantic nodes with successful retry, and stale-owner invalidation. An additional compilation readiness guard is now under validation: bind-only/early recovery results cannot be exported as checked source owners, while completed checking with diagnostics remains distinguishable from unchecked state. Full suites are running.

This does not yet wire the registry into Program's import/global lookup. Source-aware typed lookup, merges, cycles, and dependency invalidation remain under #480/#487; no benchmark readmission or speed claim.

Pushed three conventional commits to origin/main as Chris Breuer, without coauthors:

• 9d8be00d7: staged payload transfer and atomic checked-semantic publication.
• 202f24b9a: production source-owner/provenance registry, coordinated rollback, stale revision invalidation, and checked-source readiness guards.
• 53dbc4796: verified results, reproduction commands, limitations, and README link.

Full tests pass: 4,252 checker, 183 driver, 101 program, 69 CLI, 33 benchmark-harness/report. Fourteen focused transfer tests include cancellation, existing-key/enum preservation, exhaustive allocation faults, and metadata failures after full payload preparation. Registry tests cover real source text/HIR, same-path replacement, invalid/stale nodes, rollback after a declaration mapping was prepared, and successful retry. The compiled-owner test now uses the production registry rather than a test mapper. Bind-only compilation is rejected as an unchecked owner; completed checking with diagnostics remains distinguishable from unchecked state.

Fresh ReleaseFast binary SHA-256: 6d6b278c9df4db5a67171436def69c720fbe4d91e3171e8221c6d9cb161f4134. Against verified TS 6.0.3 and native TS 7.0.2, results are unchanged: eighteen positive workloads pass; Home passes sixteen workload gates but fails both graph gates; all 42 tuple and 36 assertion controls pass; global audit Home 30/44 versus each baseline 44/44; imported-owner audit Home 8/20 versus each baseline 20/20. Thus fourteen global and twelve owner-audit Home cases still fail. Frozen tuple/predicate inputs are unchanged. No timing run or new speed claim.

#504 is complete for atomic publication/provenance. #480/#487 remain open: Program lookup does not consume these records yet. The shared transfer pool must use one registry's declaration handles for all declaration-bearing types, including the local owner; handles are not local HIR IDs. Readiness means phase completion, not semantic parity. Source-aware lookup, merging, cycles, imported-record caching, and dependent invalidation still need integration. Unregistering invalidates provenance but does not implement program-wide dependency invalidation.

See the documented checkpoint. Local evidence is retained in bench/vs_tsgo/results/owner-publication.xWNTr8. Neither graph is readmitted, and the remaining timing rows stay provisional.