…979)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…full-history backfill (#979)

Build the Subscription primitive as a new leaf sub-crate in the dig-store
workspace: a per-store managed object that watches one CHIP-0035 singleton's
lineage and keeps the local set of .dig files in sync with its full on-chain
history.

- Networkless decision core (decide) + state machine (Subscription) driven over
  four injected seams (ChainWatch/CapsuleFetcher/HeldCheck/Persistence), so the
  policy is pure + unit-testable with no chain and no network.
- Generalizes dig-node's single-latest-tip gap-fill to full-history backfill:
  tip-first then oldest to newest, missing-tip retry with accruing attempts.
- Two load-bearing invariants, tested: fail-closed (never fetch/verify against
  an unconfirmable root) and reorg/permanence (a superseded root is retained,
  never evicting an already-held .dig -- CLAUDE.md 5.1).
- Extracts + canonicalizes the SubscriptionSet + subscription-set codec from
  dig-node subscription.rs (dig-node consumes this in Phase 2, deferred).

SPEC-first normative contract in crates/digstore-subscription/SPEC.md.
Workspace version 0.15.1 -> 0.16.0 (minor: new crate/capability).

Refs #979

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…d, real-flow test (#979)

The retry attempt counter reset to 1 every tick in the real reconcile flow:
reconcile_tick calls mark_pending (status -> Pending) immediately before
record_fetch_result, whose Err branch only read a prior Failed record, so the
in-flight Pending clobbered the accrued count. Carry the prior failed-attempt
count through the Pending transition (Pending { attempts }) so a capsule that
fails N consecutive ticks records Failed { attempts: N }.

- New real-flow test drives reconcile_tick across 3 failing ticks and asserts
  attempts == 1,2,3 (the prior test bypassed mark_pending and masked the bug),
  then a success flips to Held.
- observe_lineage now ignores a lineage whose store_id != the subscription's, so
  a buggy ChainWatch cannot repoint the history to a foreign store (+ test).
- SPEC: align the attempt-accrual wording with the real flow; note the store_id
  guard; note CapsuleFetcher MUST land-before-Ok or the capsule re-fetches forever.

Refs #979

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>