fix: aggregation state adoption on reopen + single-flight backfill + query-cap ratchet removal

- AggregationIndex: defineAggregate before init no longer forces a backfill.
  init reconciles instead of clobbering: the app definition wins, persisted
  state is adopted on hash match, a write landing pre-adoption forces an exact
  rescan, and a successful state load clears the backfill flag. New ready()
  settles every adoption decision before query paths consult backfill state.
- brainy: backfills are single-flight and batched. Concurrent queries share one
  store walk and every pending aggregate fills from that same walk; the old
  behavior let each concurrent query wipe the others' partial state and start
  its own full walk, so a store under steady aggregate traffic never converged.
  queryAggregate also waits for persisted definitions before deciding an
  aggregate does not exist.
- paramValidation: recordQuery is telemetry-only. The duration-based cap
  ratchet (x0.8 per recorded query while lifetime-average exceeded 1s, floored
  at 1000 - below the documented 10000 auto floor, reported under a stale
  basis label) is removed; the cap comes from its construction-time basis or
  explicit overrides alone.
- storage: __aggregation_* and singleton system keys (brainy:entityIdMapper)
  are recognized before the unknown-key warning fires; routing is unchanged.
- docs: find-limits cap-immutability note, aggregation reopen/adoption
  semantics, RELEASES.md 8.5.1 entry.

src/storage/baseStorage.ts

@@ -377,7 +377,14 @@ export abstract class BaseStorage extends BaseStorageAdapter {
       id.startsWith('statistics_') ||
       id === 'statistics' ||
       id.startsWith('__chunk__') ||      // Metadata index chunks (roaring bitmap data)
-      id.startsWith('__sparse_index__')  // Metadata sparse indices (zone maps + bloom filters)
+      id.startsWith('__sparse_index__') || // Metadata sparse indices (zone maps + bloom filters)
+      id.startsWith('__aggregation_') || // Aggregation engine definitions + state (routing is
+                                         // identical to the unknown-key fallback these keys hit
+                                         // before being listed here — this only kills the
+                                         // per-boot "Unknown key format" warning)
+      isSingletonSystemKey(id)           // Known singletons (e.g. brainy:entityIdMapper) hit the
+                                         // same warn-then-route fallback without this — the
+                                         // routing below already handles them identically
 
     if (isSystemKey) {
       if (isSingletonSystemKey(id)) {