fs store: preserve recoverable states and terminate broken observes

[YuniqueUnic]

Closes #233.

Summary

• prevent HashContext::persist() from destructively replacing non-Partial storage with Poisoned
• distinguish missing external references from store-owned corruption and metadata/I/O failures
• try all external data candidates during load and export
• wait through Initial/Loading, emit empty only for NonExisting, and terminate observe for Poisoned

This keeps an empty bitfield meaning “valid entry with no verified data” and uses the existing stream failure path for broken entries, following the design discussion in #214.

Recovery semantics

• all external paths missing: NonExisting, allowing a normal re-fetch/import
• owned data/outboard missing, invalid external metadata, permission/DB/I/O failure: terminal Poisoned
• first external path missing but a later candidate is readable: use the later candidate

Tests

• safe partial extraction without mutating complete/missing states
• transitional observe waiting and poisoned observe termination
• missing vs invalid external metadata
• external candidate fallback across restart for observe and export
• all external files removed followed by successful re-import
• missing store-owned data returns an observe error without panicking

Verified with:

• cargo test --all-features (103 unit passed, 2 ignored; 6 integration passed; 17 doctests passed)
• cargo clippy --all-targets --all-features -- -D warnings
• cargo fmt --all -- --check