GBC RTC clobber: distinct sidecar cloud slots + cross-ext write-guard + verify harness

[terafin]

cat <<'EOF'
The cloud-side sibling of the dedup-key/size-classifier work this branch already carries — folded onto it (Idunn option B) so it is ONE branch: classifier + dedup-key (from feat-scanner) + slot-de-collision + write-guard + verify harness. Base shows just my 2 commits.

Bug

A GBC RTC game stores .srm (32KB SRAM) + .rtc (8B clock sidecar); both uploaded under slotName="default" collided as competing versions of one record → /latest returned the newest (.rtc) → the download wrote the 8B .rtc OVER the 32KB .srm (then removed the old variant). Data loss. (Ullr repro, Pokémon Crystal.)

Fix (two layers, save-format spec by Ullr / RSM model by Idunn)

• ROOT — resolve_slot_name_for_sync: sidecars (.rtc/.mpk/.cpk) → distinct slot "<primary> (<LABEL>)" (default (RTC) / (Controller Pak) / (Cartridge Pak)) — parenthetical, never the ::/: conflict-key delimiter, mirroring the PSX "Memory Card 1/2" precedent. Primaries (incl. container-equiv srm/sav, mcr/vmp/gme) keep the base slot. So .srm/.rtc become separate (rom,slot) records, never competing as versions.
• GUARD — allow_write: at both download/write sites, never write a canonical whose format crosses the sidecar/primary boundary onto a mismatched target (SIDECAR_FORMATS = {rtc,mpk,cpk}). Sidecars must match exactly; primary↔primary (PSX mcr→vmp etc.) always allowed (no regression). Uses RSM /latests new format field (Option; None on older RSM → prior behavior).

Verification harness (for Ullrs real-save matrix, no network)

• scanner::classify(path,&bytes) -> {system, format, is_sidecar} (bytes-feedable split of classify_supported_save).
• explain-sync --fixtures-dir D --cloud-state S [--manifest M]: offline decision-dump — per fixture prints classify · upload-slot · cloud-format · guard (ALLOW/SKIP). Reads fixtures-manifest.tsv (<relpath>\t<identity>) + cloud-state keyed <identity>::<slotName>; identity used as-is (bare SHA1 GB / projection-key N64-pak/PSX).

Gate evidence

• Size-based gameboy classifier retained (Idunns guardrail): "rtc" => (1..=64) ✓; dedup-key present ✓; slot+guard+harness intact ✓.
• 62cb895 (feat-preserve-rtc) was redundant vs this branch (same size-classifier + dedup-key, clippy-collapsed) → dropped in the fold; conflict-free.
• 118 lib tests pass (incl. allow_write matrix, slot-label, classify, no-regression primary↔primary). explain-sync verified end-to-end: legacy collision → .srm guard=SKIP (clobber prevented); fixed → both ALLOW.
• SSH-signed (siliconspirit), firewall clean, api.rs format field is mine (no overlap).

Base is feat/scanner-libretro-format-batch to show the slot/guard delta cleanly — redirect to intarweb-dev if youd rather gate it as the unified carry.
EOF