feat: add configurable filesystem crash durability - #37

Summary

• add ADR 0001 defining filesystem crash-durability levels, defaults, ordering, capability degradation, post-rename failure semantics, and created-directory scope
• add selectable none, file, and file-and-parent-directory behavior through FilesystemPiClientConfig while preserving file as the default
• apply preserved mode before the final temporary-file sync and capability-detect direct-parent sync with degrade/strict policies
• retain the direct parent before rename and verify its followed target around rename so path replacement/retargeting cannot redirect sync or produce a false durability success
• report pre/post-commit durability failures through FilesystemDurabilityError.destinationVisible
• add deterministic operation/failure/race seams, cross-platform tests, end-to-end durability benchmarks, generated dist, and recovery/security documentation

Validation

• npm run check
• npm run build
• npm test — 41 tests, 38 passed, 3 Windows capability skips, 0 failed
• npm run test:coverage — 88.06% lines, 86.04% branches, 87.50% functions
• npm run benchmark
• npm run verify:package — 29 packed files verified
• npm audit --audit-level=high — 0 vulnerabilities
• git diff --check
• local pi-lens safe analysis — 0 blocking diagnostics
• hosted Ubuntu Node 22/24, Windows Node 22, macOS Node 22, and CodeQL matrix

Review follow-up

• 24a646e: pin the direct parent with a pre-rename handle
• 45f4a3a: verify retained parent identity before/after rename and fail unconfirmed on mismatch
• b8d133a: verify followed parent target so stable symlinked parents work while retargeting is detected
• all Codex P2 threads answered and resolved

Closes #35