feat(8.0): auto pre-upgrade backup — hard-link snapshot before the 7.x→8.0 migration

David's ask: back up the brain before the one-time upgrade, drop it after. On
open, when the on-disk format is stale (a 7.x→8.0 rebuild will run) and the store
holds data, brainy hard-link-snapshots the brain dir to a sibling
`<brainDir>.migration-backup` BEFORE any provider rebuilds — near-zero cost/space
(shared inodes; the store is immutable-by-rename), instant even at scale. Removed
automatically once the upgrade verifies + stamps the marker; retained on failure
for rollback. Default-on; opt out with `migrationBackup: false`.

- Reuses the existing snapshotToDirectory() hard-link farm via new optional
  adapter methods createMigrationBackup()/removeMigrationBackup() (filesystem
  only — feature-detected; memory + non-fs are a graceful no-op).
- Taken before the native provider inits, so it captures true pre-migration
  state; a prior failed upgrade's backup is reused, not overwritten.
- Best-effort: a backup failure never blocks the upgrade (the migration is itself
  safe — reads canonical, reconstructable, self-heals). Catastrophe-insurance
  against a migration bug, not a data-loss guard or an off-device backup.

4 lifecycle tests (adapter hard-link / reuse / remove-without-touching-live /
empty→null; stale-epoch reopen create+remove; opt-out; memory no-op). Gates:
typecheck 0, build 0, test:unit 1753/1753, layout-migration suite 5/5.

src/types/brainy.types.ts

@@ -1673,6 +1673,21 @@ export interface BrainyConfig {
    */
   migrationWaitTimeoutMs?: number
 
+  /**
+   * Take an automatic **pre-upgrade backup** before a one-time 7.x → 8.0
+   * migration rebuilds the derived indexes, and remove it once the upgrade
+   * verifies (retain it on failure, for rollback). On the filesystem adapter
+   * this is a **hard-link snapshot** of the brain directory — near-zero cost and
+   * space (shared inodes; the store is immutable-by-rename), even at scale.
+   * The migration is already structurally safe (it only reads canonical records,
+   * derived indexes are fully reconstructable, and a failed upgrade self-heals on
+   * re-open), so this is catastrophe-insurance against a migration *bug*, not a
+   * data-loss guard — and NOT a substitute for an off-device backup. No-op for
+   * non-filesystem storage and for a brain with no persisted data.
+   * Default: `true`. Set `false` to opt out (e.g. you run your own backup).
+   */
+  migrationBackup?: boolean
+
   /**
    * Vector index configuration (Brainy 8.0).
    *