feat(conformance): the golden-log fold oracle — encoder bytes and fold semantics pinned by content hash

One deterministic v2 log (nine facts covering every fold-relevant behavior:
genesis, after-images with minted ints, a deferred embed pending→landed,
a sameAsGeneration vector ref, a verb, a tombstone, and an all-deduped
empty commit) whose ENCODED BYTES and FOLDED STATE are both pinned by
sha256 literals. The fixture (tests/fixtures/golden-log-v2.bin, 4128 B,
byte-verified against the encoder on every run) is the shared artifact a
second reader implementation consumes — it must reproduce the identical
fold digest; the pair is normative on disagreement. The fold law is
stated in prose beside the code: generation-ordered latest-per-id,
tombstone masking, embed.landed vector application, single-hop ref
resolution, key-sorted digest.

Also: decodeGroupV2 discriminated pad filler by RECORD COUNT, silently
swallowing legitimate empty commits (an all-deduped batch at a real
generation). Pads carry generation 0 — which writers can never mint — so
the generation is the honest discriminator; empty commits stay visible.

Pins: 4/4 (encode-exact, fixture-identical, fold-exact, human-readable
spot checks beside the hashes).

src/db/factLogFormat.ts

@@ -1298,7 +1298,11 @@ export function decodeGroupV2(bytes: Uint8Array, options?: DecodeFactV2Options):
     const payload = bytes.subarray(start, end)
     if (crc32c(payload) !== expectedCrc) break // torn tail: payload CRC mismatch
     const fact = decodeFactV2(payload, options)
-    if (fact.records.length > 0) facts.push(fact) // zero-record fact = pad filler
+    // Pad filler carries generation 0 (writers can never mint it — encode
+    // refuses generation < 1). A zero-record fact at a REAL generation is a
+    // legitimate commit (an all-deduped batch) and must stay visible —
+    // discriminating on record count would silently swallow generations.
+    if (fact.generation > 0) facts.push(fact)
     offset = end
   }
   return { facts, validBytes: offset }