Add Phase 6A path-governance metadata

[ethan-tyler]

Summary

• Restacks the PR onto current main after Phase 5 landed in Add control-store projection outbox acknowledgements #319, leaving a clean four-file Phase 6A delta.
• Adds the crate-private path-governance-metadata control-store writer and token-pinned reads.
• Rejects exact, ancestor, and descendant path overlaps with range and predicate revalidation.
• Binds compiled readiness to its source StateToken, denying closed on missing, stale, or scope-mismatched state.
• Validates declaration workspace consistency and canonicalizes valid URIs exactly once.

Authority boundary

This is metadata-only. It does not move credential vending, grant enforcement, catalog DDL, public APIs, projections, snapshots, exports, or lineage/search authority.

Verification

• cargo test -p arco-catalog state_store::path_governance_metadata — 17 passed
• Focused projection-outbox, control-store, state-store, path-governance, and credential-vending suites passed
• cargo test --workspace --all-features --exclude arco-flow --exclude arco-api
• cargo check --workspace --all-features
• cargo clippy --workspace --all-features -- -D warnings
• cargo fmt --all --check
• All CI Gates commands, including repo-hygiene-check, passed
• Independent final diff audit: no actionable findings