feat(logs): add public activity logs with managed writers and ownership transfer

[twilson63]

Agents need a public activity stream that visualization tools can consume and teams can continue using as collaborators or owners change. This adds signed, append-only logs with server timestamps, verified writer fingerprints, JSON metadata, and cursor-based history reads and polling.

Owners can replace writer allowlists using revision checks and transfer ownership through signed nomination, cancellation, and recipient acceptance. Former owners lose access unless explicitly retained as writers. Log writes use existing registered CAP/Ed25519 identities, atomic permissions/revisions/replay checks, bounded payloads, and durable LMDB storage. Public reads bypass publication quotas while retaining request rate limits.

Includes API and agent documentation, a runnable Node client, and CI for type checking, regression tests and production HTTP E2E.

Validation:

• npm test: 540 tests pass across 31 files, including all 447 existing tests on current main.
• npm run test:e2e: build and eight real HTTP scenarios plus parent pass, including management, pending transfer/replay across restart, existing signed pages, and transport limits.
• npm run typecheck and git diff --check: pass.
• Independent LFG plan and implementation reviews: no remaining blockers.

API guide: docs/public-logs.md. Acceptance criteria and review evidence: docs/public-logs-release-prd.html and docs/public-logs-release-progress.html.

Operational note: include LMDB_PATH-logs in backups. No log deletion or lost-key recovery is included. Registry status checks and log mutation transactions use separate database environments, as documented.

[hyperio-mc]

Reviewed and approved. Verified locally on the branch:

• typecheck clean (tsc --noEmit)
• npm test: 540/540 pass across 31 files
• npm run test:e2e: 9/9 real production-HTTP scenarios pass (create/append/outsider denial, cursor pagination + CORS + exhausted quota, concurrent contiguous sequences, existing page publish/render, writer edits + cancel + pending handoff, restart persistence + replay protection, explicit retention = writer-only, chunked-oversize + stricter global cap)
• git diff --check clean

Security-critical paths look solid:

• Signature verification (logSignature.ts): canonical request over method/path/timestamp/nonce/digest, body digest match, 64-byte Ed25519 round-trip check, timestamp skew window, and a fresh registry re-check (checkLogSigner) inside the mutation transaction — good defense against key revocation races.
• Replay protection (storage/logs.ts): nonce consumed atomically within the LMDB transaction; checkWrite rejects already-used nonces before the mutation commits.
• Ownership transfer: owner manages, only the nominated fingerprint can accept; revision check (409 on conflict) prevents concurrent mutation; self-nomination rejected in both route and storage; retain-previous-owner re-adds old owner as writer only and respects the writer cap.
• Input validation: strict fingerprint/writer/revision/id validation, base64url round-trip on fingerprints, 64 KiB body cap enforced at transport level (index.ts) and again in the route, query params rejected on writes, metadata capped at 16 KiB and JSON-validated.
• Quota/rate: public GET/HEAD reads bypass publication quota (verifyApiKey.ts) but still pass through the global rate limiter; writes retain the quota.

Docs (public-logs.md, logInstructions.ts) are accurate and match the implementation. No blockers. Good work.