Refactor actor delivery and domain storage boundaries

[smiggleworth]

Actor send helpers expose only legacy error categories, which fold timeouts into stopped actors and payload rejections into sink panics. Add lossless send_detailed methods returning the existing RouteError/DeliveryError types, while preserving the original SendError enum and existing send behavior for embedders. Context also gains detailed reply, untracked-send, and event-publish methods. MailboxSink continues to require an explicit priority-delivery implementation; single-lane sinks explicitly forward to ordinary delivery.

Move Queue recovery persistence into one cached store per actor. Normal writes and recovery share its cached keys, and ordinary typed iterators decode index and header rows lazily. Index validation, authoritative reserved-ID fallback, and header recovery use one read snapshot. Index replacement remains atomic. KV BEGIN carries the Fitz-owned WritePolicy, with one shared wire-policy inventory for decoding and broker remapping and explicit conversions at the engine boundary.

Rust embedding migration: add .into() to Midge options used in KvMessage::Begin, or use WritePolicy directly. Existing exhaustive SendError matches and MailboxSink implementations remain compatible. Wire formats, persisted formats, and broker configuration signatures are unchanged. Header recovery no longer materializes full records, but recovered live state and ready-ID sorting still scale with queue size; no constant-memory or throughput claim is made.

Update Midge from b7e20515 to 4fe106ce (current upstream main at update time), including bounded cloud recovery, Windows persistence fixes, and reduced SST metadata requests. Adjust the cloud-options regression to allow Midge to reserve read-cache memory while checking positive memtable/read capacity and the configured memory bound.

Validation:

• Hosted CI passed on f26e4979, including both state-model seed variations and the parallel library test pass: https://github.com/cntryl/fitz/actions/runs/34030876342

• RUST_LOG=off cargo test --locked --workspace: 2187 passed, 0 failed, 1 existing ignored test, including integration tests and doctests.

• cargo fmt --all -- --check and pedantic Clippy across the workspace, all targets, and all features passed.

• Documentation, benchmark-contract, and module-size policy checks passed.

• Regression coverage includes exhaustive legacy SendError matches, detailed ActorRef/Context delivery errors, a compile-fail guard requiring explicit priority handling, all write-policy conversions and wire choices, recovery snapshot consistency, authoritative ID fallback, lazy header decoding, and failed index replacement atomicity.

The compatibility regression failed to compile before the follow-up. The reserved-ID regression observed a later writer's value before the snapshot fix. Both now pass. An earlier validation run of the initial draft hit the existing 5 ms Notice retry test while Clippy ran concurrently; the complete final workspace run passed without concurrent compilation.

Closes #236.

AI assistance: Codex implemented the requested audit fixes and review follow-ups. The patch was reviewed against the current source, persisted codecs, public callers, and validation output.