fix: add NULL hash guards to prevent v5.3.3 regression

Fixed critical bug where CommitObject.walk() didn't guard against NULL parent
hash, causing "Blob metadata not found: 0000...0000" error when calling
getHistory() on fresh databases.

This is a SYSTEMATIC fix, not just a patch:

Infrastructure:
- src/storage/cow/constants.ts: NEW - NULL_HASH constant and utilities
- Prevents hardcoding errors
- Provides isNullHash() for semantic checks

Bug Fixes:
- src/storage/cow/CommitObject.ts: Guard NULL parent in walk()
- src/storage/cow/BlobStorage.ts: Defensive check rejects NULL hash reads
- src/storage/baseStorage.ts: Use NULL_HASH constant (not hardcoded)
- src/brainy.ts: Use NULL_HASH constant (not hardcoded)

Testing:
- tests/integration/initial-commit-null-parent.test.ts: 5 regression tests
- All 17 tests pass (5 new + 12 existing COW tests)
- Zero regressions

This fix addresses the root cause of 4 consecutive bugs (v5.3.0-v5.3.3):
missing defensive programming for sentinel values in COW storage.

Fixes: Workshop team bug report (v5.3.3 regression)
Tests: 17/17 pass (5 new regression + 12 existing COW)
Build: SUCCESSFUL (zero errors)

src/storage/baseStorage.ts

@@ -303,7 +303,9 @@ export abstract class BaseStorage extends BaseStorageAdapter {
     const mainRef = await this.refManager.getRef('main')
     if (!mainRef) {
       // Create initial commit with empty tree
-      const emptyTreeHash = '0000000000000000000000000000000000000000000000000000000000000000'
+      // v5.3.4: Use NULL_HASH constant instead of hardcoded string
+      const { NULL_HASH } = await import('./cow/constants.js')
+      const emptyTreeHash = NULL_HASH
 
       // Import CommitBuilder
       const { CommitBuilder } = await import('./cow/CommitObject.js')

src/storage/cow/BlobStorage.ts

@@ -15,6 +15,7 @@
  */
 
 import { createHash } from 'crypto'
+import { NULL_HASH, isNullHash } from './constants.js'
 
 /**
  * Simple key-value storage interface for COW primitives
@@ -257,6 +258,18 @@ export class BlobStorage {
    * @returns Blob data
    */
   async read(hash: string, options: BlobReadOptions = {}): Promise<Buffer> {
+    // v5.3.4 fix: Guard against NULL hash (sentinel value)
+    // NULL_HASH ('0000...0000') is used as a sentinel for "no parent" or "empty tree"
+    // It should NEVER be read as actual blob data
+    if (isNullHash(hash)) {
+      throw new Error(
+        `Cannot read NULL hash (${NULL_HASH}): ` +
+        `This is a sentinel value indicating "no parent commit" or "empty tree". ` +
+        `If you're seeing this error from CommitObject.walk(), there's a bug in commit traversal logic. ` +
+        `If you're seeing this from TreeObject operations, there's a bug in tree handling.`
+      )
+    }
+
     // Check cache first
     if (!options.skipCache) {
       const cached = this.getFromCache(hash)

src/storage/cow/CommitObject.ts

@@ -16,6 +16,7 @@
  */
 
 import { BlobStorage } from './BlobStorage.js'
+import { isNullHash } from './constants.js'
 
 /**
  * Commit object structure
@@ -336,7 +337,10 @@ export class CommitObject {
     let currentHash: string | null = startHash
     let depth = 0
 
-    while (currentHash) {
+    // v5.3.4 fix: Guard against NULL hash (sentinel for "no parent")
+    // The initial commit has parent = null or NULL_HASH ('0000...0000')
+    // We must stop walking when we reach it, not try to read it
+    while (currentHash && !isNullHash(currentHash)) {
       // Check max depth
       if (options?.maxDepth && depth >= options.maxDepth) {
         break
@@ -364,7 +368,7 @@ export class CommitObject {
         break
       }
 
-      // Move to parent
+      // Move to parent (can be null or NULL_HASH for initial commit)
       currentHash = commit.parent
       depth++
     }

src/storage/cow/constants.ts

@@ -0,0 +1,59 @@
+/**
+ * COW Storage Constants
+ *
+ * Sentinel values and utilities for Copy-On-Write storage system.
+ *
+ * @module storage/cow/constants
+ */
+
+/**
+ * NULL_HASH - Sentinel value for "no parent commit" or "empty tree"
+ *
+ * In Git-like COW systems, we need a way to represent:
+ * - Initial commit (has no parent)
+ * - Empty tree (contains no files)
+ *
+ * We use a 64-character zero hash as a sentinel value.
+ * This should NEVER be used as an actual content hash.
+ *
+ * @constant
+ * @example
+ * ```typescript
+ * const builder = CommitBuilder.create(storage)
+ *   .tree(NULL_HASH)  // Empty tree
+ *   .parent(null)      // No parent (use null, not NULL_HASH)
+ *   .build()
+ * ```
+ */
+export const NULL_HASH = '0000000000000000000000000000000000000000000000000000000000000000'
+
+/**
+ * Check if a hash is the NULL sentinel value
+ *
+ * @param hash - Hash to check (can be string or null)
+ * @returns true if hash is null or NULL_HASH
+ *
+ * @example
+ * ```typescript
+ * if (isNullHash(commit.parent)) {
+ *   console.log('This is the initial commit')
+ * }
+ * ```
+ */
+export function isNullHash(hash: string | null | undefined): boolean {
+  return hash === null || hash === undefined || hash === NULL_HASH
+}
+
+/**
+ * Check if a hash is valid (non-null, non-empty, proper format)
+ *
+ * @param hash - Hash to check
+ * @returns true if hash is a valid SHA-256 hash
+ */
+export function isValidHash(hash: string | null | undefined): boolean {
+  if (isNullHash(hash)) {
+    return false
+  }
+  // SHA-256 hash must be exactly 64 hexadecimal characters
+  return typeof hash === 'string' && /^[a-f0-9]{64}$/.test(hash)
+}