[armagankaratosun]

What changed

Adds product-wide metadata maintenance to the control plane:

• firecube snapshot take|list|show|diff: content-addressed images of a product's metadata
• firecube migrate adopt|run: recorded, journaled, metadata-only migrations. Adopting a foreign store is a separate step.
• firecube release create|verify|list
• the exclusive maintenance claim that every recorded writer checks
• producer identity in run records
• the compact cache (renamed from the WAL snapshot cache)

Why

Closes #127, #128, #129, #130, #131. Refs #133, whose text still says migrate run adopts implicitly. It no longer does.

Affected behavior

• User / CLI: three new command groups. migrate run on a store with no control plane exits 1 with the adopt hint. migrate adopt on a Zarr v2 store warns.
• Plugin authors: new MigrationStep contract in firecube.ingestor.api, entry-point group firecube.migrations.
• Operators / production: writers refuse while a maintenance claim is held.
• Stored formats or control-plane state: new .firecube/metadata/, releases/ and compact/. meta.producer on run records. Two reserved root attributes, firecube_release and firecube_last_modifier. Additive.

Type of change

• New feature (non-breaking)
• Documentation

Checks run

• uv run ruff check .
• uv run ruff format --check .
• uv run pyright
• uv run --with bandit bandit -c pyproject.toml -r src scripts -lll
• uv run pytest --strict-deps -m "not slow and not s3 and not docs_static and not snapshot and not race" -q (88% coverage, 1 skip needing FIRECUBE_OBJSTORE_URL)
• Docs build: uv run mkdocs build --strict

Follow-up work

Zarr v2 stores accept ingest writes that mix v3 documents beside v2 (handoff written). A failed migrate run cannot be abandoned. The per-write claim check accepts an absent claim.

Contributor certification

• Commits are signed off (git commit -s) with my real name and a reachable email.
• No credentials, generated products, caches, or virtualenvs are included in this PR.
• If AI assistance materially shaped this change, I disclosed it here and added an Assisted-by trailer.