test: close RFC-026 B2a retain-all gate

[aaltshuler]

Summary

• close RFC-026's private B2a unbounded retain-all correctness and evidence gate
• add structural no-delete/no-adoption guards plus local and configured-RustFS provider failure coverage
• add a term-separated 1/8/32/128 retained-history instrument and wire the focused gates into CI
• refresh the RFC and developer docs to record the implemented boundary and the remaining B2-common work

Boundary

This slice changes tests, evidence tooling, CI routing, and documentation only. It does not activate a public streaming surface, change the storage format, add retention limits, or authorize OmniGraph to delete canonical durable MemWAL objects. Lance's losing shard-manifest-CAS temporary staging object remains explicitly distinct from durable authority.

Validation

• cargo test --locked -p omnigraph-engine --features failpoints --test forbidden_apis --test memwal_stream --test memwal_stream_cost — 18 + 29 + 20 passed; 3 decision-scale tests ignored by default
• on-demand local and configured-RustFS 1/8/32/128 retained-history sweeps passed
• configured-RustFS provider-failure cell passed
• targeted Rust formatting, git diff --check, and scripts/check-agents-md.sh passed

Known baseline failure

cargo test --workspace --locked reaches warm_read_cost::native_branch_controls_use_one_post_gate_manifest_capture, which expects (2, 1) but observes (3, 2). The exact failure reproduces on clean base commit 9aa2ed10; this PR changes no production or warm-read code.

Greptile Summary

This PR closes the private RFC-026 B2a retain-all evidence gate. The main changes are:

• Structural guards for MemWAL deletion and adoption paths.
• Local and configured-RustFS provider-failure coverage.
• Retained-history cost checks at 1, 8, 32, and 128 generations.
• CI routing for the focused MemWAL test suites.
• Updated RFC and developer documentation.

Confidence Score: 5/5

This looks safe to merge.

• The updated structural guard covers delegated destructive gateways and their callers.
• The new provider-failure and retained-history checks are wired into CI.
• No blocking issue remains in the changed code.

Important Files Changed

Filename	Overview
crates/omnigraph/tests/forbidden_apis.rs	Adds structural inventories and guards for raw MemWAL access, reclamation, adoption, and delegated deletion.
crates/omnigraph/tests/memwal_stream.rs	Adds local and configured-RustFS failure coverage for retained, non-authoritative generations.
crates/omnigraph/tests/memwal_stream_cost.rs	Adds retained-history evidence across increasing generation depths.
.github/workflows/ci.yml	Runs the focused MemWAL and RustFS checks with non-vacuous test assertions.

_{Reviews (2): Last reviewed commit: "test: close delegated MemWAL delete rout..." | Re-trigger Greptile}

Context used:

• Context used - AGENTS.md (source)
• Context used - CLAUDE.md (source)