Build Helm Channels revision workflow

[waple0820]

Outcome

Turns Helm documents into stable Artifacts with immutable Revisions, visible review state, rendered history comparison, Fork lineage, and owner-controlled stable intranet Channels.

What changed

• separates logical Artifact catalog records from append-only content-addressed Revisions in IndexedDB v4
• migrates legacy documents without rewriting source bytes
• adds Draft / Reviewed / Published state, revision timeline, sandboxed visual compare, and Fork provenance
• adds stable /a/<id> and immutable /r/<sha>.html publication with compare-and-swap update and revoke
• makes Bridge same-ID submissions immutable revisions instead of identity conflicts
• preserves Channels state and lineage through HARC/1 extensions and ordered recovery
• blocks encoded/static paths and share-directory files from public fallback routing

Verification

• python3 -m unittest discover -s tests -p "test_*.py" — 16 passed
• node --check app.js and node --check channel-store.js
• browser smoke — contract passed, repair passed, Channels store 24 assertions passed
• live Chromium walkthrough — review, history compare, publish, stable public read, Fork lineage, revoke, and Fork publication guard
• git diff --check

Owner self-review questions

• Can any normal path overwrite evidence bytes? No: revisions are add-only and content-addressed; catalog edits are separate.
• Can stale state silently advance a public Channel? No: publish and revoke require the observed base digest and return 409 on drift.
• Can an intranet visitor enumerate the library or private share catalog? No: management is loopback-only and encoded/private/static paths are regression-tested.
• Can a Fork accidentally publish into its source Channel? No: publication requires the current HDOC manifest ID to equal the logical Artifact ID.
• Can backup/delete break visible lineage? Sources with inbound Forks are archived, loaded for history, and included once in backup.
• Is rollback possible? Stable addresses can be revoked; immutable Revision URLs and older bytes remain intact.

Boundary

Still single-owner and local-first. No collaborative editing, remote identity, automatic sync, ACLs, or multi-writer merge semantics.