Fix undo ledger holes at the store seam and refuse outdated draft stores

[kostyafarber]

Adversarial re-review of #119 and #121 (rebased on #124) found the undo ledger and the SQLite draft store disagreeing about what a replay restores. This PR fixes the seam and adds a structural test invariant so the class stays fixed.

Bugs fixed

1. Wedged batch undo (FK violation on reverse replay). Undoing [DeleteAxis, DeleteSource] replays steps reversed, so the source row is re-inserted before its axis row exists; the location upsert hits a foreign-key violation, the hand-back mechanism restores the entry, and every retry fails identically — undo is permanently stuck. The store now skips location entries on axes that have no row (mirroring replace_font_state); the axis step that follows in the same replay re-emits the located sources and fills the values in. Both batch orders plus redo/undo cycles are covered by regression tests.

2. SourceCreated replay wiped source fields. The change record carried only name + location, so undoing a source delete (or an axis delete, which re-emits located sources) blanked filename, color, role, layer_name, and the source lib in the draft store while memory kept them — divergence that surfaced on crash-recovery. SourceCreated now snapshots the full source and the store handler writes all of it, including source_lib.

3. SCHEMA_VERSION never bumped. feat: UFO round-trip preservation contract #119/fix: designspace saves preserve project structure with atomic writes (re-target) #124 added tables and columns (fontinfo_remainder, source_lib, font_binaries, sources.color, sources.layer_name) while the version stayed 1, so older draft stores failed opaquely with "no such table". Version is now 2 and an outdated store is refused with an actionable error ("delete the draft store and re-import the font") — per the pre-release policy: baseline edited in place, no migration machinery.

4. order_index never properly persisted. Created axes/sources/glyphs were hardcoded to order 0 and a glyph rename reset the glyph's order. Creates now append at COUNT(*) (mirroring the in-memory Vec::push), deletes compact the sequence (mirroring Vec::remove), and identity changes no longer touch order.

5. Bonus hole caught by the new invariant: restoring a deleted glyph layer (source-delete undo, glyph replay) re-created a bare row — contours, anchors, components, guidelines, and layer lib never reached the store. GlyphLayerValue now carries the layer's full content and replays emit it alongside the created row.

Structural enforcement

workspace_test.rs now routes every undo/redo through undo_and_verify / redo_and_verify, which reload the font from the draft store and assert_eq! it against the in-memory font (Font equality covers all persisted data, index caches excluded). This is the invariant that catches bugs 1, 2, 4, and 5 structurally, and new intent tests inherit it.

Tests

• cargo test --workspace: all green (122 shift-font, 39 shift-store, 48 shift-workspace, plus backends/bridge/source suites)
• New: old-schema refusal (v1 fixture), full-source SourceCreated round-trip, missing-axis location skip, order append/compaction, [DeleteAxis, DeleteSource] batch undo/redo in both orders, source extras surviving delete undo
• cargo fmt and cargo clippy --all-targets clean; pre-commit hooks (check/fmt/clippy/test) passed per commit

🤖 Generated with Claude Code