feat(8.0): visibility field (public/internal/system) on nouns + verbs

Adds a reserved, top-level `visibility` field (mirrors the subtype rollout):
'public' (default, surfaced) | 'internal' (developer app-internal — hidden from
default find/count/stats, opt-in via includeInternal) | 'system' (Brainy
plumbing, library-set only).

Fixes a real leak: the VFS root entity counted in getNounCount() and appeared in
find() (a fresh brain reported 1 entity). It is now visibility:'system' →
excluded from every user-facing surface. Developers also get a first-class
hidden-unless-asked tier (e.g. learned internals vs user-exposed data).

- Reserved (RESERVED_ENTITY_FIELDS / RESERVED_RELATION_FIELDS) — spoof-proof from metadata.
- Threaded through add/relate/update/transact; surfaced top-level on reads.
- Default exclusion in counts (baseStorage), find()/related() (hard candidate
  filter via excludeVisibility — keeps topK/limit correct), and stats;
  includeInternal/includeSystem opt-ins.
- VFS root marked 'system'.

Tests: visibility.test.ts 17/17 (fresh-brain getNounCount()===0, internal hidden
+ opt-in, verb symmetry, top-level surfacing, metadata-spoof rejection). Unit
1431 green; count-synchronization integration now passes (off-by-one fixed).

src/vfs/VirtualFileSystem.ts

@@ -231,6 +231,9 @@ export class VirtualFileSystem implements IVirtualFileSystem {
           console.warn('⚠️  VFS: Root metadata incomplete, repairing...')
           await this.brain.update({
             id: rootId,
+            // Re-assert system visibility on repair so a pre-8.0 root (created before the
+            // tier existed) is moved out of the default-visible counts/find() too.
+            visibility: 'system',
             metadata: this.getRootMetadata()
           })
         }
@@ -250,6 +253,12 @@ export class VirtualFileSystem implements IVirtualFileSystem {
         data: '/',
         type: NounType.Collection,
         subtype: 'vfs-root',  // Standard subtype for the VFS root collection (7.30+)
+        // visibility 'system' (8.0): the VFS root is Brainy's own plumbing, not user data,
+        // so it is hidden everywhere by default (getNounCount()/find()/stats()) and surfaces
+        // only via find({ includeSystem: true }). 'system' is intentionally not part of the
+        // public AddParams.visibility union ('public' | 'internal') — this is the single
+        // sanctioned internal setter, hence the cast.
+        visibility: 'system' as 'public' | 'internal',
         metadata: this.getRootMetadata()
       })