622 constrain or retire create path to holon node

[owleyeview]

Retire generic create_path_to_holon_node production ingress

Closes #622. Also documentation updates in map-dev-docs PR
#10.

Summary

create_path_to_holon_node accepted a caller-selected Path, LinkTypes value, and target
ActionHash and called create_link directly. Its one production caller always supplied the same
three fixed values, so this replaces it with a typed, storage-owned LocalHolonSpace write and moves
the remaining raw authoring — which only Integrity tests need — into holons_test_probes.

Its legacy_ingress classification was compliant, so this is not policy remediation. It is retired
because the supported write contract is narrower than the authority it exposed and no supported
external caller needed the difference.

What changed

Typed writer. New persistence_layer/local_holon_space.rs with index_local_holon_space(&LocalId)
— fixes the canonical path, link type, and empty tag internally, mirroring
holon_storage::index_under_all_holon_nodes. No #[hdk_extern], so it adds no WASM export and no
coordinator-surface row. guest_shared_objects::holon_service::create_local_path is deleted and
GuestHolonService::create_local_space_holon calls the new operation directly.

Extern retired. CreatePathInput and create_path_to_holon_node removed from
persistence_layer/holon_node.rs; its [[export]] row removed from coordinator-surface.toml. No
replacement production ingress accepts caller-selected path, link-type, action-hash, or tag values.

Integrity unchanged in strength. Validation logic, rejection variants, and message strings are
byte-identical. Only the rationale on validate_all_holon_nodes_create changed: it no longer rests on
the removed extern, since peers author infrastructure links directly and the canonical base and
lineage-root target are DHT invariants regardless of the local write surface.

Probes. Two new narrow externs in holons_test_probes, each fixed to one Integrity rule and
structurally unable to author a valid canonical link: the noncanonical-base probe refuses a path equal
to the selected type's canonical path, and the update-target probe refuses any target that is not an
Update. They share a closed two-variant RootIndexLinkType and a private link-authoring helper.
all_holon_nodes_delete_for_test was narrowed from a caller-supplied create-link hash to a semantic
root LocalId, resolving the canonical link itself.

Tests. Canonical behavior now comes from production paths: a new bootstrap_local_holon_space
harness helper drives a real unanchored dance through dance_adapter, and the bootstrap test asserts
the link is created, resolves through the canonical path getter, is reused by a second unanchored
session, and deletes cleanly. Canonical AllHolonNodes creation is proven through
holon_storage_persist(PublishRoot). The rejection tests moved to the probe conductor and were renamed
to say they prove peer-authored Integrity enforcement rather than public-ingress behavior. The
AllHolonNodes delete test's setup now comes from PublishRoot, not raw authoring.

Not changed. get_holon_node_by_path keeps its behavior and its legacy_ingress classification;
its disposition is a separate read-contract decision. LocalHolonSpace uniqueness, conflict,
replacement, discovery, and newest-link selection are untouched.

Rebased onto post-SL5 main

#636 and #637 landed first, so this branch was rebased onto them. Two resolutions are worth calling out
for reviewers:

• guest_holon_service.rs import block — 630 -Storage SL4 — Retire the legacy SmartLink facade #636 rewrote the same block for its retrieval changes.
  Purely textual; the two sets of body edits do not overlap.
• The obsolete HolonNodeUpdates coverage was deleted, not migrated. 631 - SL5 - retire revision indexes #637 removed the variant from
  LinkTypes and left behind a test that proved the type's unreachability by naming it at the
  create_path_to_holon_node ingress. Once no production ingress accepts a caller-selected LinkTypes,
  there is no wire surface left to refuse the retired name, so that property is unstatable as a runtime
  test. It is now proven structurally instead — the variant is absent from the enum, and the artifact
  audit proves no export accepts one. The test, this branch's holon_node_updates_author_create_for_test
  probe, and its manifest row all went with it.

Because #637 renumbered LinkTypes, the DNA hash changed; artifacts are rebuilt on this branch.

Testing

Verified on the rebased branch: npm run fmt:check, npm run check, and
cargo check --manifest-path tests/sweetests/Cargo.toml --all-targets.

The Nix-gated suite — npm run test:unit, npm run build:happ, npm run build:probes -w map-happ,
npm run check:happ-artifacts, npm run sweetest — is being re-run post-rebase.

The artifact audit is the real proof of removal: the manifest row is gone, so a surviving export would
fail its bidirectional inventory diff as unexpected, and it reads WASM out of the packed DNA and hApp
rather than a Cargo target.

[evomimic]

Thanks for re-basing an reconciling merge conflicts, @owleyeview

Approved.

PR 640 satisfies #622: it retires the generic production ingress, replaces its sole supported use with the typed storage-owned LocalHolonSpace writer, preserves Integrity coverage through narrow test probes, and keeps canonical setup on production paths. The required authoritative documentation has now landed in map-dev-docs PR #10.

CI passed on the reviewed head. Manual verification also passed for happ and host builds, npm test, and npm start.