Finalize archive snapshot and credential redaction contracts

[farach]

Summary

• Keep onet_archive_download() returning its documented shared cache path while internal archive readers parse the exact private verified snapshot acquired with its matching receipt.
• Serialize the archive cache decision, force download, source-receipt commit, and snapshot creation under one cache lock with a download-safe timeout.
• Add deterministic forced-refresh coverage for snapshot ownership, lock behavior, receipt and digest consistency, and cleanup on success and error, alongside the adapter pathway coverage.
• Match credential parameter names explicitly after percent decoding, case normalization, separator normalization, and camel-case normalization while preserving benign author, monkey, state, and ordinary parameters.
• Cover query, fragment, hash-route, malformed, encoded-name, case-variant, warning/error, and legacy-receipt redaction paths without exposing secret values.

Stack

• Initial feature commit parent: 522b092616149d191a973638402fc55cd18e0ed3.
• The target advanced to 98ea87519f259a11e26e02f8d8a3eec0a5c958b0 during validation, so that parent was merged without rebasing to keep this draft stack current.
• Audited candidate PR Finish cache snapshot contract #21 and reproduced only its correct single-lock acquisition design plus missing OAuth/cloud aliases; its stale history was not cherry-picked and PR Finish cache snapshot contract #21 was not modified.
• Base: farach-harden-release-gates.

Validation

• devtools::document(): passed after the exported mutability documentation update.
• Full testthat: 855 passed, 2 API-key skips, 0 failures, 0 warnings.
• Built and installed blocked-network suite: 851 passed, 6 CRAN-context skips, 0 failures.
• Clean-install validation: 2 of 2 rounds passed.
• External R CMD check --as-cran: 0 errors, 0 warnings, 2 expected notes for new/development version metadata and unavailable clock verification.
• Deterministic archive race: 20 of 20 repeated rounds passed.
• pkgdown::check_pkgdown() and full build: passed; 87 HTML files, 537 valid O*NET matches, 0 broken renderings, and 35 expected inactive @examplesIf warnings.
• URL check: 0 issues across 6 URLs.
• Workflow YAML: 2 files parsed successfully.

[farach]

Superseded by the smaller reviewed current-base implementation in authoritative draft PR #18. Branch retained for audit; do not delete.