feat(sync): add transport-neutral transactional bloom-sync engine (SYNC-02) #650

Program package: SYNC-02 (risk 3, warm, device gate required)

Dependency: SYNC-01 merged as 7cf81bc.

Acceptance:

• add one transport-neutral bloom-sync runtime owner; no Syncthing, cloud, socket, listener, or provider dependency
• initialize a private local Ed25519 device identity and manage explicitly authorized peer keys without exposing key material in diagnostics
• export bounded immutable bundle directories from regular local payload files, signing the RFC 8785-compatible canonical manifest defined by SYNC-01
• validate in the fixed bounds/schema/bundle/device/key/signature/compatibility/conflict order and reject malformed, oversized, unauthorized, stale-key, tampered, or incompatible input without touching live Saves
• classify all nine SYNC-01 outcomes without using wall time; stage only new-lineage/fast-forward candidates, make exact replay/stale ancestry idempotent, and quarantine or preserve review-required input
• publish only an explicitly selected staged candidate while the game session is inactive, after creating a verified save snapshot, with same-directory atomic replacement and retained rollback material
• keep generic transfer access to Saves read-only and emit only bounded privacy-safe structured status
• integrate the runtime into the payload, bloomctl, network event reconciliation, dependency/provenance manifests, shell coverage, and architecture/security/save-sync documentation

Out of scope:

• transport selection or synchronization daemon (SYNC-03)
• Save Sync UI or remote conflict-resolution UX (SYNC-04)
• physical controls/LCD/audio/gameplay certification

Validation:

• focused bundle/identity/authentication/conflict/publication shell tests with synthetic Saves only
• complete shell suite, native/ASan suites, deterministic UI gates, static analysis, pinned dependency/provenance validation, clean ARM build, required CI
• signed Mini Plus warm/device evidence only after the currently installed UI-12 shutdown candidate is physically resolved