feat: add acquisition collection backend foundation

[SamuelBrudner]

Summary

• add first-class Experiments with validated Session and Dataset memberships
• add logical acquisition collections with immutable, bounded, content-addressed manifests and durable capture receipts
• keep high-cardinality member facts inside canonical manifest JSON instead of creating one SQL/work-graph/provenance entity per file
• enforce read opacity, project authorization, canonical lock ordering, post-lock rereads, idempotent capture semantics, monotonic completeness, and database-owned current pointers
• add migrations 0059_experiments and 0060_acquisition_collections on the current 0058 head
• document the backend contract and every deferred downstream integration

Why this replaces #136

#136 mixed the backend model with watcher, Dataset promotion, context/MCP/provenance, and UI work across 126 files and is no longer mergeable. This recovery PR is based directly on main and limits the review to a 47-file backend foundation with explicit boundaries. #136 can now close as superseded.

Deferred by contract

This PR intentionally does not add:

• Dataset snapshot references, collection-aware hashes, or promotion
• export, evidence-bundle, ARA, ownership/offboarding, or durable service-principal integration
• MCP/generated clients, decision context, portfolio/search/project-graph projections
• watcher/retry/local-capture plumbing
• frontend, review, or other UI workflows

Those surfaces retain their existing behavior and are tracked for focused follow-up in bead lab-tracker-tqe7.

Validation

• current GitHub CI: all 8 jobs green, including live PostgreSQL migrations, Python 3.10, Windows, macOS, e2e, and the full test job
• focused acquisition/Experiment/migration/opacity suite: 167 passed, 1 local environment-gated PostgreSQL skip
• adjacent legacy repository/API suite: 119 passed
• SQLite upgrade/downgrade and corruption constraints: passed
• the live PostgreSQL gate caught and verified the corrected repository-head assertion for 0060_acquisition_collections
• Ruff across src/lab_tracker and tests: clean
• targeted mypy: 11 source files passed
• compileall, Alembic single-head check, and git diff --check: clean
• independent adversarial review: all P1/P2 findings fixed; final recommendation PUBLISH
• real concurrent PostgreSQL races remain simulated with lock hooks rather than exercised as parallel database clients

Prescribed by bead lab-tracker-8e46.