fix: Fence selected tier runtime and writer operations

[buildingjoshbetter]

Selected tier operations can otherwise use different model generations across admission, inference, and publication. This change pins the selected runtime for each whole operation and rejects stale source/vector writes or mismatched model responses before publication.

• Add transaction-preserving writer fences for the exact connection, generation, descriptor, and table pair. Borrowed transactions retain caller ownership.
• Validate per-response embedding and reranker receipts, including one reranker result row per requested pair. Existing model choices, dimensions, batching, and retrieval limits stay fixed.
• Serialize shared Engine connection snapshots, initialization, and eligible reconnects while preserving ready borrowed operations and Python 3.10 compatibility. Keep model preparation outside SQL transactions.
• Correct the native test fixture to restore only its overridden module key. Restoring all of sys.modules after importing torch caused the reproduced native GC crash. GC stays enabled and prior assertions are preserved.

Three atomic implementation commits separate writer fences, response receipts, and runtime integration; two test-only commits fix UTF-8 source decoding and wait for shared maintenance teardown before temporary database removal on Windows. Stacked on draft #826; refs #795, #756, and #753.

Validation: sequential offline installed-wheel GPUBox full gates passed with native SQLite flags enabled. Combined: 3,371 tests and 2,875 subtests, 214.646 s, log SHA256 ddf00c62cbdbdbf613ac4ddf5e77b14c974f3592c0e8f167eddb7a4e2fbb43dd. Isolated publication: 3,239 tests and 2,230 subtests, 212.439 s, log SHA256 4f203e8a11edc316a84e7728e73a16ec5edab02eeadf2a6d3b88d6eb3a4e897d. Both: 17 skips, 3 deselections, exit 0, no timeout or OOM kill. Actual Python 3.10 compatibility: 47 passed, one native-only skip. Independent runtime/writer/receipt review passed 48 probes, connection ownership review 41, and GC fixture review 11. Ruff, Python 3.10 syntax, exact source manifests, public scope, and privacy checks passed. All test data is synthetic; failed evidence is preserved.

The original hosted Windows runs exposed 11 test-fixture decoding errors. An immutable cp1252-default negative control reproduced all 11; the corrected loaders passed 72 safe tests with one native-only skip under the same emulation. Only nine loader calls changed; production and assertions are unchanged. After that correction, 33 hosted checks passed and one Windows job failed during temporary-directory cleanup after its warm-search assertions passed. Engine close intentionally detaches from its shared worker; the test now explicitly waits for the worker to close its own connection. Independent teardown review passed seven probes and all six prior assertions are retained. Both full gates above were rerun after this test-only correction. Hosted checks on this updated head remain pending.

Public manager/MCP/CLI adoption remains a separate unpublished Unit C change. Serving admission is process-local; arbitrary raw SQL is not fenced. These results do not establish a hard cancellation latency, a whole-process memory bound, or a fix for the original 26.24 GB Mac incident. Draft only; no merge or release.