Finalize archive snapshot and credential redaction contracts

[farach]

Summary

• Keep onet_archive_download() returning its documented shared cache path while internal archive readers parse the exact private verified snapshot acquired with its matching receipt.
• Serialize the archive cache decision, force download, source-receipt commit, and snapshot creation under one cache lock with a download-safe timeout.
• Add deterministic forced-refresh coverage for snapshot ownership, lock behavior, receipt and digest consistency, and cleanup on success and error, alongside adapter pathway coverage.
• Match credential parameter names explicitly after percent decoding, case normalization, separator normalization, and camel-case normalization while preserving benign author, monkey, state, and ordinary parameters.
• Cover query, fragment, hash-route, malformed, encoded-name, case-variant, warning/error, legacy-receipt, OAuth verifier/consumer, and cloud credential paths without exposing secret values.

Stack

• Initial feature commit parent: 522b092616149d191a973638402fc55cd18e0ed3.
• Current base: farach-harden-release-gates at 053a184030713f19095e215ab2081751e867fe9c.
• Audited candidate PR Finish cache snapshot contract #21 and reproduced only its correct single-lock acquisition design plus missing aliases; its stale history was not cherry-picked and this session did not modify PR Finish cache snapshot contract #21.
• Parent advances were merged without rebasing, preserving the required initial ancestry and omitted version/as_of constraint semantics.

Validation

• Full testthat: 875 passed, 2 API-key skips, 0 failures, 0 warnings.
• Built and installed blocked-network suite: 871 passed, 6 CRAN-context skips, 0 failures.
• Clean-install validation: 2 of 2 rounds passed.
• External R CMD check --as-cran: 0 errors, 0 warnings, 2 expected notes for new/development version metadata and unavailable clock verification.
• Deterministic archive race: 20 of 20 repeated rounds passed.
• pkgdown::check_pkgdown() and full build: passed; 87 HTML files, 537 valid O*NET matches, 0 broken renderings, and 35 expected inactive @examplesIf warnings.
• URL check: 0 issues across 6 URLs.
• Workflow YAML: 2 files parsed successfully.

[farach]

Superseded. This delayed duplicate does not address the final independent-review blockers now being fixed on authoritative PR #18. Branch retained for audit; do not delete or reopen.