feat(8.0): reserved-field contract — one canonical location, typed prevention, unified read/write

Brainy-owned field names (noun/verb, subtype, createdAt, updatedAt,
confidence, weight, service, data, createdBy, _rev) now have exactly one
home — top level — enforced by three layers driven from a single source of
truth, src/types/reservedFields.ts (RESERVED_ENTITY_FIELDS /
RESERVED_RELATION_FIELDS, exported):

1. Compile time — AddParams/UpdateParams/RelateParams/UpdateRelationParams
   metadata (and the transact() ops that extend them) reject a literal
   reserved key as a TypeScript error while keeping generic T ergonomics
   (typed bags, untyped brains, index-signature shapes, and a documented
   exemption for T-declared reserved keys). Pinned by @ts-expect-error
   type tests run under vitest typecheck mode on every unit run.

2. Write time — the 7.x update() remap is ported to 8.0 and extended to
   every write path: add/update/relate/updateRelation, their transact()
   mirrors, and db.with() overlays. User-settable fields lift to their
   dedicated param (top-level wins when both are supplied — closes the 7.x
   trap where update({metadata:{confidence}}) silently no-oped), and
   system-managed fields drop with a one-shot warning naming the right
   path. A remapped subtype satisfies subtype-pairing enforcement exactly
   like a top-level one.

3. Read time — every storage combine goes through one canonical hydration
   helper (hydrateNounWithMetadata / hydrateVerbWithMetadata over
   splitNoun/VerbMetadataRecord), so reserved fields surface ONLY top-level
   and entity/relation.metadata carry ONLY custom fields on live reads,
   batch reads, paginated listings, getRelations by source/target, streamed
   verbs, and historical asOf() materialization alike.

Read-path echoes found and fixed (previously the full stored record —
including the verb type key — leaked inside metadata): noun pagination,
verb pagination, getVerbsBySource/ByTarget (adjacency + shard fallback),
getVerbsBySourceBatch (which also dropped subtype/data), and the
filesystem verb stream. getRelations() results now surface
confidence/updatedAt top-level via verbsToRelations, updateRelation() no
longer erases service/createdBy, relate() persists its top-level
confidence/service params, and the dead convertHNSWVerbToGraphVerb echo
path is deleted. Import paths (CLI extract, deduplicator, coordinators,
neural import) write confidence through the dedicated param instead of the
bag. UpdateRelationParams is now exported from the package root.

Documented for consumers in docs/concepts/consistency-model.md ("Reserved
fields") and RELEASES.md. Regression tests ported from the 7.x fix and
extended to the full 8.0 contract (17 runtime tests + 41 type-level
assertions); full unit suite 1427/1427, db-mvcc integration 24/24.

RELEASES.md

@@ -198,6 +198,25 @@ this rename; only the API surface moved.
   through earlier pins and are not reported by `db.since()`. Writes you want
   to travel back through go through `transact()`. This is the documented
   contract, stated rather than papered over.
+- **Reserved fields have one canonical location — enforced at every layer.**
+  The Brainy-owned field names (`RESERVED_ENTITY_FIELDS`:
+  `noun`/`subtype`/`createdAt`/`updatedAt`/`confidence`/`weight`/`service`/
+  `data`/`createdBy`/`_rev`; verb mirror `RESERVED_RELATION_FIELDS` with
+  `verb` for the type key) are now (1) a **compile error** inside any
+  `metadata` param — `add`/`update`/`relate`/`updateRelation` and the
+  matching `transact()` ops; (2) **normalized at write time** for untyped
+  callers — user-settable fields remap to their dedicated top-level param
+  (top-level wins; `update({metadata:{confidence}})` no longer silently
+  no-ops, closing a 7.x trap), system-managed fields drop with a one-shot
+  warning naming the right path; (3) **split at read time** through one
+  canonical helper, so `entity.metadata` / `relation.metadata` contain ONLY
+  custom fields on every read path — `get`, `find`, `getRelations` (several
+  paginated/by-source/by-target paths previously echoed the full stored
+  record, including the `verb` type key, inside `metadata`), batch reads,
+  and historical `asOf()` reads. `getRelations()` results now also surface
+  `confidence`/`updatedAt` top-level, and `updateRelation()` no longer
+  erases a relationship's `service`/`createdBy`. See "Reserved fields" in
+  `docs/concepts/consistency-model.md`.
 - **Unchanged from 7.31:** per-entity `_rev`, `update({ ifRev })`
   (`RevisionConflictError`), and `add({ ifAbsent })` work exactly as before,
   and `ifRev` is also accepted on `transact()` update operations (a conflict