feat: harden File Provider conflict resolution

[OpenCow42]

Summary

• make kDrive ETags the authoritative content version and replace existing files by stable file_id with If-Match
• stage new and modified file bytes before network work; use deterministic SHA-256/idempotency tokens and preserve stale or raced edits as renamed conflict copies
• apply combined File Provider fields in a deterministic move/rename → contents/date → trash order, returning unsupported fields as still pending
• map fail-on-conflict and stale deletion into File Provider-native recovery, signal resolved transient errors, and expose staged recovery copies in Activities
• add and mandate maintenance of the mission-critical conflict truth table and safety register

Automatic policy

• content edit/edit: conditional replace, otherwise preserve both
• create/name collision: server rename policy; directory/rename collision retries with a unique conflict name
• rename/move: local same-field intent wins; a move-only request preserves an independent remote rename
• trash: local intent wins and remains reversible
• permanent delete: reject stale base with .deletionRejected; 404 is idempotent success

User intervention that remains

• .failOnConflict: reveal/export the retained copy and choose or merge versions
• stale permanent delete: review the item File Provider recreates, then retry if still desired
• authentication/quota: sign in again or free/increase kDrive storage
• unsupported metadata: remains pending and can soft-lock until implemented
• upload failure after system retries: indexed staged bytes become Needs Attention after 24 hours and can be recovered from Activities

Residual safety findings

The normative register is doc/CONFLICT_RESOLUTION_TRUTH_TABLE.md. Open findings are:

• no documented conditional ETag primitive for permanent delete
• unsupported File Provider metadata can remain pending
• retry cadence is still system-owned; there is no provider pending-operation scheduler or Retry Now
• directory replay, case/type collision preflight, recovered-parent handling, and large-upload conditional parity remain follow-ups

Package dependency

• potassiumChannel #49 and #50 are merged.
• This PR now pins the immutable merged main revision 81014d32428b2f367c74c7f1616793c7a5b2ba01; it no longer depends on a feature branch.
• A future package release can move the project back to a semantic-version range without blocking this PR.

Validation

• potassiumChannel swift test: 558 tests passed before package merge
• macOS focused mutation suite: 25 tests passed; the selected test plan executes it twice
• HTTP collision/conditional-upload request regressions passed
• macOS, iOS 26.5 Simulator, and generic visionOS app builds passed with code signing disabled
• macOS build-for-testing passed against merged potassiumChannel revision 81014d3
• snapshot round-trip coverage now verifies ETag/revision persistence; an upgrade regression verifies missing columns are migrated in place
• plutil -lint Config/potassiumProviderFileProviderInfo.plist and git diff --check passed

Validation limitations

• no guarded live-kDrive mutation/collision test was run
• the first GitHub run correctly exposed missing ETag/revision SQLite persistence; the corrected snapshot round-trip and in-place migration passed the fresh macOS CI run
• the local full-scheme runner cannot launch its app/UI host reliably while this machine's disk is critically full; build-only validation completed locally