feat(wom): add v0.3.296 private objet metadata writer

[mow-coding]

Summary

• add the reviewed private objet source-metadata intake, authority-chain, write-plan, journal, and receipt contracts
• add the Windows/local-NTFS fail-closed writer and Win32 retained-handle primitives
• expose the approval service/CLI boundary while keeping search, finder, MCP writing, UI, provider, network, object-byte, database, and index work out of scope
• update capability, upgrade, release, privacy, versioning, and AI provenance documentation for v0.3.296

Safety and behavior

• exact intake digest, expected plan digest, human review, and external-writer quiescence are required
• persistent object/private lock order and retained file identities guard every mutation boundary
• append, rollback, recovery, replay, collision, interruption, residue, and close-fault paths fail closed
• an uncoordinated reader can make ordinary FileRenameInfo return error 5; this is reported as a cleaned no-change manual_hold, followed only by a fresh dry-run and separate approval after reader release
• atomic old-or-new reader observations are claimed; wait-free progress through uncoordinated readers is explicitly not claimed

Validation

• independent final audits: GO, P0/P1/P2 = 0/0/0
• core contract/writer/authority/Win32/approval: 243 passed, 20 subtests
• Win32 + approval: 167 passed, 2 subtests
• complete Archive CLI partition: 1,214 passed, 6 skipped, 997 subtests (all 1,220 selected tests covered exactly once)
• ObjetCapture CLI: 127 passed, 2 skipped, 26 subtests
• release/docs/package focused bundle: 267 passed, 4,343 subtests
• canonical wheel fresh-install smoke: 110 resources, 132 files, four entrypoints, both MCP servers at 121 tools, Runtime Skill lifecycle, onboarding preview/write, strict Doctor

Pre-merge release candidate

• filename: wom_kit-0.3.296-py3-none-any.whl
• bytes: 1,365,771
• SHA-256: 7c959cbf7827514d1f0dc0c737b9ace7a6f7f4f7463efc60674533acc3eb44c6

The public release asset will be rebuilt and reverified from the exact merge commit; this pre-merge candidate will not be uploaded as the final asset.