fix: keep reserved sentinels virtual

[marcus-pousette]

Problem

ROOT and TRASH are protocol sentinels, but materialization could treat them like application nodes before rejecting an operation. That could create physical sentinel rows, lose former-parent metadata, suppress the first move-to-Trash event, or emit false replay moves.

Fix

• Canonical operations targeting TRASH are deterministic no-ops.
• Canonical structural inserts, moves, deletes, and tombstones targeting ROOT are deterministic no-ops.
• Payload(ROOT, ...) remains the supported document-level payload.
• Normal nodes may attach to virtual TRASH without creating a TRASH row.
• First/repeated moves and former-parent opRefs remain correct through canonical replay.
• Invariant validation rejects a physical TRASH row or parented ROOT.
• Empty SQLite order-key BLOBs round-trip as empty bytes.

Strict input contract

Reserved targets do not bypass #218's structural-key validation. Malformed ROOT/TRASH operations are rejected before no-op handling; only canonical operations reach the sentinel fast path.

There is no old-log exception, schema version, migration marker, row scan, backfill, or upgrade replay. Development databases containing the earlier shape must be recreated.

Fast paths

• Schema initialization performs no sentinel scan or replay scheduling.
• Ordinary application-node operations add only reserved-ID comparisons.
• Canonical reserved-target operations return before snapshotting or touching node/payload stores.
• A node attached to virtual TRASH stores no sibling order key and creates no sentinel parent row.

Size

11 files, +234/-31 relative to #186. Removing the prior compatibility/migration design cut the PR by more than 400 lines.

Verification

• cargo test --workspace
• strict workspace Clippy
• Rust and TypeScript formatting
• interface and engine-conformance TypeScript builds
• malformed ROOT/TRASH rejection and canonical no-op coverage
• git diff --check

Stack

Stacked on #186.