feat(storage): atomic multi-statement programs (#131) - #208

A write now commits a Transaction: every change of one commit, across any
number of shards, at one revision. The WAL stores it as one checksummed
record whose trailing newline is the commit boundary, written with one
append and (in immediate mode) one fsync. Recovery replays the longest
intact prefix of records, so a restart yields the state after an exact
number of commits, never part of one.

- PersistBackend::append(shard, updates) becomes commit(txn). Inserts and
  deletes commit one-op transactions; startup multiplicity corrections and
  prefix clears commit one transaction across all their relations, so a
  failed prefix clear now leaves every relation intact.
- TxnOp is a typed enum (facts today); rule and schema changes become new
  variants. A checksummed record this server cannot decode fails startup
  with StorageError::WalUnreadable instead of being skipped.
- Tuples are stored with the lossless batch codec (base64), fixing NaN and
  infinite floats that JSON wrote as null and replay then dropped. v1
  records still replay so v1 data dirs migrate with their WAL.
- A crash-torn last line is cut off. Any other damage stops replay there
  and the cut-off bytes are saved to wal/current.wal.<ms>.corrupt, instead
  of skipping the damaged record and replaying later ones out of order.
- A failed write or fsync is cut back to the exact committed length; if
  that fails, the repair runs before the next write, rewrite or shutdown,
  so a commit that returned an error is not replayed.
- Remove the unused legacy src/storage/wal.rs, a second WAL format.

Hot path: same locks (WAL mutex, shard map, per-KG write lock), nothing
on the query path; one record per commit instead of one per tuple.

Part of #131

Consecutive fact statements of a program (+, -, conditional delete,
update) are staged without touching the knowledge graph and committed
together under the KG's existing write lock: one effective delta, one
WAL record at one logical time, one snapshot publish, and one
notification per changed relation after the publish. A statement with
other persistent effects (schema, rule, meta command) or the end of the
program commits the run first. If any statement of a run fails, none of
them is applied and none reports success.

Conditional deletes and updates evaluate on the snapshot plus the
changes staged before them and record the relations their query reads.
The commit refuses a stale read when one of those relations or a rule
changed, and the run is staged again with a short random backoff, up to
8 times, before failing with a conflict. Writes to other relations never
conflict. A cancelled (timed out) program never commits.

insert_tuples_into and delete_tuples_from are one-statement programs on
the same path, so there is one write path. Update statements now notify
the relation they change instead of "multiple". State-dependent insert
rejections (arity, view, vector index, schema) report code validation.

Partial #131 (slice #169).

A program that changes persistent state now commits all of it as one
transaction on its knowledge graph: facts, schema declarations, persistent
rules and rule removals (-name, .rule drop, .rule drop prefix, .rule
remove, .rule clear). Statements apply in order to staged copies of the
catalogs under the KG's existing write lock, so a fact is checked against
a schema declared earlier and a conditional delete or update after a rule
change evaluates with the new rule. Everything is written as one WAL
record and published as one snapshot: readers see one rule generation
with its data. The first failing statement fails the program; nothing is
applied, its query does not run, and subscribers are not notified.

Commands that cannot join the transaction (.kg, .rel, .rel drop, .clear,
.index, .compact, inspection, user, ACL, ontology, subscription) are
rejected with code unsupported before any statement runs when they share
a program with writes. Programs without writes run as before.

- TxnOp::Catalog carries each changed rule's and persistent schema's
  state after the commit, so replay is idempotent. Catalog files record
  the revision they reflect and are written atomically; the WAL keeps a
  catalog change until both files are saved past it, and startup replays
  what the files miss. KG drop removes its WAL catalog changes.
- Every catalog API is a one-statement program: one write path.
- .ontology install deploys as one transaction; .ontology remove drops a
  pack's rules in one transaction and each relation on its own.
- Python SDK load() docs state the real transaction boundary.

Hot path: fact commits take the same locks as before (the catalog log
lock only when a transaction carries catalog changes); queries are
untouched. Rule and schema changes now cost a WAL fsync and two atomic
catalog saves.

Part of #131 (slice #170).

make doc-check (rustdoc -D warnings) rejects intra-doc links from public
module docs to private modules; name them in plain text instead.