Add portable directory checkpoint policy

[roackb2]

Summary

• add a reusable bounded portable-directory capture and staged-restore primitive
• reject unsafe paths, symlinks, integrity mismatches, resource-limit violations, and merge-style restore targets
• migrate memory checkpoint filesystem mechanics onto the primitive while preserving exact memory-v1 serialized bytes
• document the shared primitive boundary and public advanced API

Verification

• yarn test: 143 unit files / 938 tests; 49 integration files / 441 tests
• yarn build
• focused portable-directory and memory-checkpoint tests
• git diff --check

Boundary

This PR does not claim that a durable working directory is complete. It intentionally leaves working-set scope, immutable generation and manifest storage, warm-root recovery, heartbeat pre-terminal checkpoint ordering, Execution Host wiring, release, and deployment to follow-up slices.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.