Harden write confirmation and mutation handling

[colinds]

Summary

• replace reusable HMAC confirmations with process-local, single-use stored write plans
• execute the exact previewed mutation at most once and distinguish definite rejection from an unknown outcome
• fix directly coupled session, cookie, delegation, and password-input issues

This keeps one current confirmation contract. It does not add legacy token or session migration paths.

Verification

• bun run check
• packaged smoke test with Bun and Node

Stack: 2 of 4. Depends on #5; followed by #2.