Follow-up to f2b533af41 (#9096). Two changes:
1. Store-owned pruning choke point. The preserve-set invariant (current
client + latest full-state author) was duplicated at five caller sites
— exactly how #9089/#9096 happened. OperationLogStoreService now owns
it in pruneClockForStorage; setVectorClock, saveStateCache, and
commitFileSnapshotBaseline prune internally, and callers (snapshot,
compaction, hydrator, sync-hydration, server-migration) pass raw
clocks. This also covers the previously unpruned setVectorClock site
in _restorePreservedLocalOps. Importing limitVectorClockSize outside
the store (client wrapper or @sp/sync-core) now fails lint
(no-restricted-imports, sabotage-verified on both import routes).
2. Atomic mergeRemoteOpClocks. The merge was a read-compute-put across
separate transactions reading the per-tab cache — two tabs could
interleave and lose clock entries. It is now one readwrite
transaction with a fresh in-transaction read of the durable clock,
mirroring the reducer checkpoint (regression test proves the stale-
cache lost update).
Pruning behavior tests move to the store spec (caller specs mock the
store and can no longer observe pruning); caller-level prune tests are
deleted, the sync-hydration case becomes a wiring test. Docs updated.
fdbc2c1a86