feat(state): M2 ledger CRUD — ref-counting, ports, provisioning (spec 03/08)

Higher-level data layer over the spec-08 tables, all scoped by Docker context
and intended to run under the machine-global flock:

- shared services keyed by (engine, majorVersion) — upsert/status/get/list
  (the version-conflict policy: one instance per pair).
- reference counting: AddRef (idempotent), RemoveProjectRefs, RefCount,
  ProjectsUsing, AllRefs, and PruneRefsForProjectsNotIn (self-healing reconcile).
- port allocation inside the lock: AllocatePort (stable per owner/purpose,
  persisted immediately, advisory isFree ∪ persisted set), PortFor,
  AllocatedPorts, ReleasePortsFor.
- provisioning ownership ledger: RecordProvisioned, ProvisionedFor,
  AllProvisioned, OrphanedProvisioned, RemoveProvisionedForProject,
  AllocateRedisIndex (0-15, lowest-free, stable).

Comprehensive unit tests (race-clean).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: gustavobertoi