fix: make workspace cursors replica-safe

[kauandotnet]

Summary

• replace per-mount random identities and private one-use cursor state with an injectable shared cursor codec and stable server-owned mount identity
• add a bounded, versioned AES-256-GCM cursor codec with key-ring rotation support
• bind list/search continuation state to the storage client, normalized prefix, trusted scope, mount, operation, normalized query, effective limits, and authorization expiry
• define universal list-cursor semantics: non-consuming ancestor replay, page-size-independent position, and portability to a fresh compatible driver/client while the provider continuation remains valid
• extend provider conformance with changed-limit, descendant, conditional-delimiter, and fresh-replica replay plus deliberate one-shot and delimiter-disabled regressions
• update AI SDK schemas, package exports, security/provider docs, filesystem restart coverage for list and search, packed-consumer coverage, and Changesets metadata

The authenticated outer expiry is an authorization ceiling. It does not extend an underlying provider token's lifetime or promise snapshot isolation/provider availability; provider invalidation remains an operational list failure.

Cross-repository delivery

Supports nestm-dev/artifact-studio#4

Dependent Artifact Studio PR: https://github.com/nestm-dev/artifact-studio/pull/19

This branch is rebased onto storage PR #21's squash merge, d996b921b0b41247cbe642728d6bf30ca09a15fc, and adds no redundant cursor capability. This library PR remains the required dependency for the Artifact Studio PR and intentionally does not close the Artifact Studio issue.

Test evidence

• pnpm run check — Oxc lint, repository-wide Prettier check, and TypeScript passed
• pnpm run test — 233 unit tests passed; 55 E2E tests passed and 4 environment/provider-gated tests skipped
• focused cursor/conformance suite — 67 tests passed
• focused provider-conformance E2E — 27 passed; 3 credential-gated live suites skipped
• pnpm run verify:pack — production build, publint --strict, and packed-package consumer passed
• pnpm dlx @arethetypeswrong/cli --pack . --profile esm-only passed for all ESM exports
• git diff --check origin/main..HEAD passed

The filesystem conformance suite always runs and proves changed-limit, delimiter-aware, delimiter-disabled, and fresh-driver replay. Live AWS S3, Cloudflare R2, and custom S3-compatible suites require dedicated credentials and remain gated.

Migrations, security, and tenant isolation

• Migrations: none; this changes library contracts and cursor representation only.
• Security: physical prefixes and provider continuations stay inside authenticated encrypted or shared server-side state. Tokens are bounded to 4096 ASCII bytes and altered, expired, cross-query, cross-operation, cross-workspace, cross-store, or unconfigured cursors fail closed with sanitized errors.
• Tenant isolation: each application supplies a stable trusted scope and mount ID. Authentication binds storage client, prefix, scope, mount, operation, normalized query, effective limits, and expiry, rejecting cross-tenant/workspace reuse.
• Operations: replicas need equivalent key rings, stable identities/limits, compatible driver configuration, and the same logical backend namespace. Outer cursors are non-consuming retry capabilities, not immutable snapshots or provider-token retention guarantees.
• Compatibility: legacy private in-memory cursors cannot migrate and intentionally fail closed. A custom driver that returns consuming or instance-bound list cursors violates the public driver contract and now fails conformance.