feat: migrate history one segment at a time

[duck8823]

Summary

• add migration 48 and a durable segment-scoped migration journal/state machine
• copy reserved history through bounded durable candidate pages and sealed immutable segment verification
• publish with pinned descriptor-relative no-replace operations and proof-specific Catalog transitions through verified shadow
• preserve Hot authority and source rows, with idempotent crash recovery and rollback from every durable phase
• bind aggregate-only evidence to source, config, commit, manifest, file, and Catalog heads
• serialize candidate SQLite images through openat/O_NOFOLLOW + fsync + atomic rename, avoiding writable pathname TOCTOU

Validation

• go test ./... -count=1
• go vet ./...
• go tool golangci-lint run
• targeted go test -race
• independent GPT-5.6 Sol structure review: APPROVE

Closes #1651