W99 contract gate — session lifecycle operations (#415)

Adds §7.4 to the core contract: listSaves, branchSession, deleteSave, the
three operations issues #266, #276, #277, #280 and #281 record two hosts
having invented for themselves.

Two decisions the design did not determine, both recorded in 90-decisions.md:

A branch retains its source's gameId and mints only a new sessionId, via
RecordIdSource. W99.2 asks for both a new id and a byte-identical replay
through the fork point; gameId is an envelope field, so those cannot both
hold literally. Issue #266's own criteria settle it — the identifier it
wants from a port is the unguessable session id, not gameId. The cost is
that gameId now names a lineage rather than a playthrough, which the
idempotent profile upsert and the {config, actionLog} fixture shape both
already absorb.

StoredSaveRecord gains a Clock-stamped savedAt, and the save list sorts by
it. savedAtSeq counts actions within one session, so it is not a total
order across a player's saves; without a real stamp the tiebreak is a
random UUID, and no host could retire the shadow index the operation
exists to replace.

Also registers invalid_fork_point, adds the per-saveId lock domain, and
moves the API coverage checklist from ten operations to thirteen.

Author: The-Running-Dev

design/04-core.md

@@ -34,6 +34,24 @@
 
 #### Migrating callers
 
+### 7.4 Session Lifecycle — Listing, Branching, Deleting
+
+#### Listing
+
+#### Deleting
+
+#### Branching
+
+#### Reproducing a stored session from its log
+
+#### Authorization is host-owned, and `SessionStore` stays caller-agnostic
+
+#### Error semantics
+
+#### Invariants
+
+#### The coverage checklist moves to thirteen
+
 ## 8. Randomness
 
 ## 9. Projection