[boburning]

Summary

• define a closed, bounded schema-1 save bundle and semantic authority
• bind canonical Bloom GameID/content identity, payload lineage, backend compatibility, RFC 8785 canonical bytes, and Ed25519 authentication
• define deterministic hash/lineage conflict outcomes without wall-clock ordering
• keep transport ownership absent, generic Saves read-only, and live-save publication forbidden
• validate the authority during release preflight and keep CI scope at risk tier 3

Verification

• focused SYNC-01 Bats: 9/9 passed
• native GoogleTest: 595/595 passed
• AddressSanitizer GoogleTest: 595/595 passed
• shell integration: 830/830 passed
• deterministic UI gallery: 10/10 exact frames
• full bounded cppcheck command: passed
• validator passed under the exact pinned ARM toolchain image (Python 3.7.3)
• full ARM build: delegated to clean Linux CI; the local Docker attempt could not consume Windows worktree gitdir paths and encountered pre-existing host-format objects before evaluating this host-only package

Scope and safety

SYNC-01 defines identity, authenticity, lineage, pairing/key lifecycle, and conflict classification only. It does not implement export, import, transport, signing, pairing, or save publication, and it has no device deployment gate.

Closes #647