Add resumable per-provider metadata archives

[jmcte]

Summary

• add versioned per-provider archive sync, document, status, and migration contracts
• persist cursors, source fingerprints, attempts/successes, freshness, item counts, and redacted failures
• support bounded idempotent upserts, explicit tombstones, retention, restart/resume, and private atomic storage
• fail closed for providers and nested body/media fields that have not explicitly opted into metadata archiving

Governing Issue

Closes #93

Validation

• Relevant local checks passed
• Required PR checks are expected to satisfy CI Gate
• Skipped checks are explained below

swift test --disable-sandbox — 130 tests passed

bash scripts/ci/run-fast-checks.sh — passed; source line coverage 89.13%, mutation checks killed expected mutations, debug and release builds passed

Synthetic tests cover restart/resume, idempotency, explicit tombstones, persisted counts, v0 migration, scan and timeout partial state, source partial failure, retention, permissions, CLI sync/status, nested JSON fields, and sensitive-provider/field rejection.

Bootstrap Governance

• Changes are scoped to the linked issue
• Contributor or PR guidance changes are reflected in CONTRIBUTING.md, .github/PULL_REQUEST_TEMPLATE.md, and docs/bootstrap/onboarding.md when applicable
• PR author enabled auto-merge where GitHub allows it, or GitHub plan-limit evidence/unavailable reason is recorded and the fallback merge-readiness policy applies
• No real secrets, runtime auth, or machine-local env files are committed

This branch is stacked on foundation PRs #101, #102, and #103. The PR remains draft until those merge and the diff collapses to the issue #93 commit; auto-merge will then be armed.

Flow Contract

• Owner lane: Hermes macOS/native archive foundation
• Repair owner: jmcte
• Autonomy class: review-gated implementation from assigned issue
• Risk class: high; durable private metadata storage and migration contract

Flow Merge Readiness

• Every blocker has a next actor and next action
• No active blocking requested changes remain
• Non-author approval is present when required
• PR author enabled auto-merge where GitHub allows it, or recorded why it is unavailable/unsafe

Next actor: foundation reviewers, then security/architecture/macOS review on this PR.

Merge Automation

• PR author enabled auto-merge with gh pr merge --auto --squash, or the reason it is unavailable/unsafe is noted below

Auto-merge is intentionally deferred while the PR is draft and stacked on #101–#103.

Notes

• Archive values remain nested JSON values; no JSON payload is embedded in a JSON string.
• Automatic backup exclusion is requested but documented as best effort; encrypted explicit backup is required for operators who opt in.
• Record identifiers, payloads, source paths, and raw provider failures are never logged.

[jmcte]

@athena-omt @pheidon @ares-omt @Hermes-omt — this high-risk archive-contract PR is stacked on #101–#103 and intentionally draft until those foundations merge. Early review is requested on cursor advancement, idempotency, migration, retention, nested JSON handling, private atomic storage, backup policy, and fail-closed sensitivity boundaries.

[Hermes-omt]

Request changes: sensitiveField(in:) only recursively inspects direct object elements of an array. A payload such as {"nested":[[{"body":"..."}]]} is accepted and persisted despite body being explicitly forbidden. I reproduced this through archive sync on the reviewed head: it exited 0 and wrote the synthetic body value into account.json.

Please make sensitive-field traversal recursive for every ArchiveValue shape (including arbitrarily nested arrays), and add a regression test covering an array nested inside an array containing a forbidden key. The existing direct nested-object test does not cover this case.

Hermes validation: exact-head checkout; swift test passed (130 tests). Live CI checks are successful; GitHub currently reports auto-merge disabled and mergeable_state=dirty.

[Hermes-omt]

Reviewed current head 7f74b1639279f0be5ae517a67c6435e83a4eb56c. The prior nested-array sensitive-field bypass is fixed with recursive traversal across all ArchiveValue shapes and a targeted regression test. Exact-head macOS validation passed: swift test --disable-sandbox; PR Fast CI and CI Gate are successful. Branch is current with main, mergeable clean, auto-merge enabled, and no unresolved review threads.