Implement deterministic GC planning and identity-preserving compaction

[flyingrobots]

Outcome

Plan garbage collection from an immutable retention snapshot and compact live physical records without moving logical identity or exposing partial publication.

Dependencies

Blocked by #17, #18, #19, and #20.

Acceptance criteria

• GcPlan is immutable, deterministic, bounded, inspectable, and #[must_use].
• Planning distinguishes live, unreachable, corrupt, ambiguous, and already retired material.
• Execution revalidates the expected catalog and retention generations before acting.
• Compaction writes and verifies new immutable segments before publishing new locations.
• BlobId, ChunkId, and lawful layout identity remain stable across compaction.
• Old segments remain readable until the new catalog generation is durably published.
• Crash injection covers copy, verify, publication, retirement, deletion, and recovery of compaction.
• Ambiguous or corrupt state is refused rather than collected.
• Model-based tests prove reads and retention sets are equivalent before and after compaction.
• Benchmarks report amplification, sync count, reclaimed bytes, latency, and peak temporary space.

Non-goals

• Application-level retention decisions.
• Secure erasure claims.
• Background scheduling policy.
• Unsafe or mmap optimization without separate measured evidence.