fix: Prepare certified inactive embedding targets

[buildingjoshbetter]

Tier rebuilds need to prepare an inactive embedding target without changing the serving tier or silently accepting a custom-model fallback. This prerequisite adds an immutable target descriptor, explicit daemon certification with actual output-width checks, and an encode-only local lease. Named completion/separation tables initialize independently of active configuration, with paired rollback and case-insensitive TEMP-shadow rejection.

The daemon reuses its existing cache, admission, deadline and CPU-recovery controls. Local preparation permits one outstanding lease and shares exact-model ownership with existing inference. The optional timed ownership path preserves legacy callers' locking behavior. Existing models, rerankers, dimensions and retrieval policy are unchanged.

Stacked on #820. Related to #795; this does not close it. No tier-switch caller adopts this API yet. Full-corpus retention, truthful activation and the original Mac memory incident remain unresolved. No whole-process byte bound or native MPS improvement is claimed.

Validation:

• Sequential offline GPUBox installed-wheel builds and full suites passed. Publication: 2,285 tests and 696 subtests; combined tree: 3,109 tests and 2,671 subtests. Both had 17 skips and 3 deselections, real sqlite-vec enabled, no timeout and no OOM kill.
• Independent review passed 37 saved probes plus two legacy lock-protocol checks. The new suite includes actual sqlite-vec pair initialization, idempotence, wrong-width refusal and owned/borrowed rollback.
• Original-source negative control: 27 assertion failures, zero errors. Removed width, permission, close and TEMP-case guards also fail their targeted assertions. Six existing fixtures remain byte-identical, preserving 809 assertions.
• The first combined full run failed five unchanged ownership tests after default lock acquisition changed. Restoring the original untimed path fixed them; failed evidence and assertions are preserved. Earlier review failures are also retained.
• Ruff, Python 3.10 parsing, exact publication mapping, source-hash, privacy and public commit-identity checks passed.

Full log SHA256: publication 993a79e7c930fb6b8604e7ddd306238e84ab59f020f3e43862e4eeaad7ed5b0d; combined 4a6586ba85124e2190f7ce4b16f621caf8bbd8d9e21b357685af9f67d8b84cba.

Draft only. Nothing is merged or released.