fix(storage): make snapshot COW and reopen GC durable

[wchwawa]

Summary

• make snapshot COW ownership explicit through durable leases and epochs
• fence physical GC against readers, writers, checkpoints, and reopen recovery
• persist dropping-tree and structural-reclaim work so crashes cannot leak or resurrect blobs
• enforce child-before-parent checkpoint durability and bounded FIFO reclamation

Why

NoKV durable restore-to-fork keeps object-backed metadata alive independently of the source snapshot. Holt must therefore preserve snapshot-shared frames across COW, checkpoint, crash recovery, and physical GC without relying on process-local ownership.

Validation

• cargo fmt --all -- --check
• cargo clippy --all-targets --all-features -- -D warnings
• cargo test --all-features
• snapshot crash/reopen, checkpoint failpoint, property, system fault, WAL replay, and write/delete churn suites

The three commits separate the storage mechanism, crash/GC integration tests, and documentation. The resulting Git tree is identical to the fully validated local tree (9502163e615f40d4aba288f0d41284659bb3c978).