ci(mirror): fence five exact forwarded owner blobs

[RecursiveIntell]

Scope

Dependent on draft #7. Add a pinned-source CI fence that compares Git blob OIDs and modes for five previously forwarded whole paths against Libraries revision 0b099ec416de60f6adafb182f1d1e83795d05c56. The paths are the governed canary, src/types.rs, and the foreign-key, search, and storage-lifecycle tests. The partially forwarded src/db.rs is deliberately excluded. This does not copy or mutate the Libraries owner.

Evidence

Eight local paired-root unit tests passed, including negative fixture cases for wrong SHA, changed bytes, changed mode, and a missing path. A controller-side read of the pinned Libraries Git tree and draft #7 Git tree reported exact matches for the five paths; the CI invocation at this new PR head must be read back separately. The first new unit-test run failed on a disposable fixture git rm after a mode change; it was changed to force removal only in the disposable fixture and the full suite passed on rerun. The Public Evidence Editor reviewed the three-file diff for narrow draft-only publication.

Limits / rollback

This is a blob-and-mode drift fence on five paths, not semantic equivalence, complete mirror parity, a standalone release, or positive Rust/Python support-event conformance. Other held paths, including src/poly_kv_backend.rs, remain unresolved; the owner file's poisoned-count len() returns a conservative zero and cannot be blindly copied as a truth-preserving fix. No merge, release, or activation is proposed. Rollback: close this draft or revert its three-file commit; leave parent drafts and Libraries untouched.