feat: committedGeneration capability + pinned durability/stability contracts

- storage.committedGeneration(): the committed watermark exposed on the
  fact-scan capability, so a provider compares its stamp's
  sourceGeneration against the store's truth without parsing the
  private manifest format (the capability source now carries both the
  live fact log and the committed closure).
- Pinned contract tests: fsync-before-ack (transact passes today; the
  single-op path is pinned via it.fails as the documented target —
  group commit must become LATENCY batching, ack waiting on the shared
  fsync, never durability skipping; the pin flips red when that lands
  so there is no cliff to discover) and scan-stability-under-rotation
  (a scan snapshot yields exactly its facts — no gaps, duplicates, or
  bleed-in — while segments rotate beneath it; the reclaim-during-scan
  variant lands with fact compaction, which does not exist yet).
- FactLog accepts a rotateBytes option so tests exercise real rotation.

src/brainy.ts

@@ -1005,9 +1005,12 @@ export class Brainy<T = any> implements BrainyInterface<T> {
       // so a provider's heal can switch from the enumeration walk to one
       // sequential fact scan whenever the log exists.
       if (typeof (this.storage as BaseStorage).setFactScanSource === 'function') {
-        ;(this.storage as BaseStorage).setFactScanSource(
-          () => this.generationStore?.getFactLog() ?? null
-        )
+        ;(this.storage as BaseStorage).setFactScanSource({
+          factLog: () => this.generationStore?.getFactLog() ?? null,
+          // The committed watermark, exposed as a capability so providers
+          // never parse the store's private manifest format.
+          committedGeneration: () => this.generationStore?.committedGeneration() ?? 0
+        })
       }
 
       // Entity-tree stamp coherence: compare the stamped sourceGeneration +