Add fail-closed primary repo relocation

[andrei-hasna]

Summary

• add dry-run-first repos registry relocate-primary with explicit --apply
• validate exact repo identity, optimistic current path, canonical target root, source/target remotes, exact HEAD, cleanliness, and duplicate targets
• atomically update only the existing primary path and insert an audit receipt
• fail closed on ambiguous exact repo names and export the SDK relocation surface

Safety

• no scan, delete, merge, or mutation of other registry rows
• present source checkouts must match the expected identity and commit and be clean; genuinely missing sources are explicitly audited
• local-path and credential-bearing remotes are rejected; receipt/output data contains only sanitized remote identity
• receipt failure rolls back the path update in the same SQLite transaction
• this PR does not execute a live registry relocation, publish/install a package, or perform a release

Verification

• focused: 59 passed, 0 failed, 171 expects
• full: TMPDIR=/var/tmp bun test — 196 passed, 0 failed, 581 expects
• bun run typecheck
• bun run build
• git diff --cached --check before commit
• gitleaks protect --staged --redact --no-banner before commit
• gitleaks git --redact --no-banner --log-opts="bad9af6b310420fe5d16433c72c09be2d12e5b49..HEAD" before push
• independent adversarial review: PASS, no P0/P1/P2 findings after reconciliation

Environment note

The default /tmp contains a stale empty /tmp/.git, which makes seven unrelated no-cloud-inventory fixtures appear nested. Running the same full suite with TMPDIR=/var/tmp passes 196/196.

Todos task: 43ac67d4-29ba-40a9-b608-f6cb44f94131
Goal: 353122da-ec88-4e01-bc35-f3c38518a9db