Complete institutional handoff and verify state restoration

[zmuhls]

Summary

Complete Steve's institutional handoff (#14) and the architecture reconciliation (#13) while preserving existing decks, uploaded files, local roles, sharing, and normalized editing. Gateway refusals now preserve safe retry and support-reference metadata, readiness rejects a doubled /v1 path, and the receiver acceptance fixture exercises the current Gateway contract.

Add a conservative SQLite/uploads snapshot and restore command. It requires stopped writers, verifies database integrity and a complete file manifest, and restores only into a new directory. Repeated account migration preserves existing ownership and roles. CI now checks institutional sign-in, persisted editing, cancellation, safe quota refusal, logout, and exported ZIP contents in Chrome.

Validation

• pnpm check: 724 tests passed; eight separately gated receiver cases skipped; shell checks and both builds passed. Svelte reports zero errors and ten existing warnings.
• All eight actual Hono/cail-client receiver cases passed against Gateway c5b54beeb3a39db0edad6cae20cccc5fe942414e with controlled identity, Registry, catalog, and provider fixtures.
• Mounted Chrome acceptance passed, including ZIP integrity, the edited heading, and preserved uploaded-file bytes.
• WAL-backed SQLite and uploads survive verified snapshot, restoration, and repeated additive migration. Tampering, existing destinations, recursive destinations, and symlinks are rejected.
• Staged secret scan and whitespace checks passed.

Release status

This is source acceptance, not live SSO or production release. The documented server is reachable but the available SSH authentication is rejected, and the repository has no private runner. The private CI release connection, production backup rehearsal, explicit existing-account mappings, and signed-in model/export acceptance remain outstanding. No production data, accounts, Gateway deployment, or mount activation was changed.