Engine: expect_revision precondition on execute (EN-8) #261

Goal. An expect_revision precondition on execute: refuse the program if the named relations changed after a given revision.

Why. Gives exact optimistic-concurrency semantics for callers that need them (a strict guard mode), beside the existing condition guards.

Done when. execute accepts expect_revision with an optional relation list; a refused program writes nothing and returns a typed conflict with the current revision; tests cover concurrent writers.

Plan reference: EN-8. Part of the Engine production readiness milestone (the current focus; tracker #199). Rule for every engine PR: millisecond query and update latency must not regress, and the perf gate runs before the PR opens.