feat: warm contract (warm/warmOnOpen/provider warm hook), configurable transact budget floor, backend-neutral vector index op names

Three pieces addressing the cold-restart-write incident where a production
deployment's first writes after every restart (33-35s each on a cold page
cache) blew the op-count-scaled transact budget mid-batch: every write is
itself a multi-op transaction, so one cold operation consumed the whole
budget, the gate before the next operation tripped, and the write rolled
back atomically - refused, retried, and refused again until the page cache
warmed passively.

- The budget's start-gating contract is now explicit and pinned: it gates
  STARTING the next operation, never rolling back completed work for
  elapsed time (the shipped schedule since 8.7.0, now stated in contract
  JSDoc, guarded by code for operation 0, and enforced by regression
  tests). The 30s floor is configurable via transactionBudgetFloorMs for
  stores whose cold operations legitimately run long.
- New brain.warm() eagerly loads the vector index, metadata index, and
  graph adjacency so first operations after a cold restart run at
  steady-state cost. Returns a WarmReport with an honest per-surface
  outcome (warmed / probed / unavailable) - never reports a probe as a
  warm. warmOnOpen: true runs it during init(). New optional provider hook
  warm() on the vector and graph plugin contracts.
- Vector-index transaction op classes renamed from the backend-specific
  AddToHNSWOperation / RemoveFromHNSWOperation to backend-neutral
  AddToVectorIndexOperation / RemoveFromVectorIndexOperation, stamping the
  active backend into the emitted op-name string (AddToVectorIndex(js-hnsw)
  vs a native provider's own identity) so journals never misdirect an
  operator toward an index that isn't running.

src/plugin.ts

@@ -381,6 +381,20 @@ export interface GraphIndexProvider {
    */
   init?(): Promise<void>
 
+  /**
+   * @description OPTIONAL. Eagerly load/fault-in backing storage (e.g. mmap
+   * pretouch) so first operations run at steady-state cost. Optional;
+   * absence means the provider demand-loads. Distinct from `init?()`: `init`
+   * is called once automatically during brain startup as part of the
+   * readiness contract (cold-load + rebuild gating); `warm` is an explicit,
+   * separate readiness step a caller opts into via `brain.warm()` (or
+   * `warmOnOpen`) specifically to pre-pay demand-load cost that `init` left
+   * lazy. A provider that already loads everything eagerly in `init?()` may
+   * implement `warm` as a no-op or omit it — `brain.warm()` falls back to a
+   * best-effort read-through probe when absent.
+   */
+  warm?(): Promise<void>
+
   /**
    * @description OPTIONAL. A native provider returns true from the moment its
    * `init()` detects a large epoch-drift until its background
@@ -947,6 +961,22 @@ export interface AtGenerationVectors {
  * are retired and never looked up.
  */
 export interface VectorIndexProvider {
+  /**
+   * @description OPTIONAL backend identity, stamped into the transaction
+   * op-name strings that surface in journals/timings (e.g.
+   * `AddToVectorIndex(js-hnsw)` vs `AddToVectorIndex(<providerId>)`) — see
+   * `src/transaction/operations/IndexOperations.ts`. Absent → the op-name
+   * string reports `unknown-provider` rather than guessing a backend name
+   * (guessing would resurrect the exact bug this field exists to prevent:
+   * an operator hunting an index that isn't the one actually running). The
+   * built-in JS index always sets this to `'js-hnsw'`; a native provider
+   * sets its own identity here (e.g. its plugin/package name) so operators
+   * reading a journal see the backend that actually ran, never a
+   * backend-specific fossil name from whichever engine wrote the original
+   * op classes.
+   */
+  readonly providerId?: string
+
   addItem(item: VectorDocument): Promise<string>
   removeItem(id: string): Promise<boolean>
   search(
@@ -1009,6 +1039,20 @@ export interface VectorIndexProvider {
    */
   init?(): Promise<void>
 
+  /**
+   * @description OPTIONAL. Eagerly load/fault-in backing storage (e.g. mmap
+   * pretouch) so first operations run at steady-state cost. Optional;
+   * absence means the provider demand-loads. Distinct from `init?()`: `init`
+   * runs automatically once during brain startup (the cold-load + rebuild
+   * readiness contract above); `warm` is a separate, explicit step a caller
+   * opts into via `brain.warm()` (or `warmOnOpen`) to pre-pay demand-load
+   * cost `init` left lazy — e.g. touching every mmap page rather than just
+   * opening the file. A provider that already loads everything eagerly in
+   * `init?()` may implement `warm` as a no-op or omit it — `brain.warm()`
+   * falls back to a best-effort probe `search()` when absent.
+   */
+  warm?(): Promise<void>
+
   /**
    * @description OPTIONAL honest durability signal (readiness contract,
    * mirrors {@link GraphIndexProvider.isReady}). `true` ⇔ the persisted