spec(port): port the concurrent add remove reconciler (Refs #8883)

[dmitrii-f-t27]

The fourth CR-CHAT-03 ring target (W3, tracker #8883, epic gHashTag/trios#1812): port of crates/trios-chat/rings/CR-CHAT-03/src/concurrent_add_remove.rs (Wave-20, L-CHAT-3-add, RFC 9420 12.2).

Two members racing to commit against the same base epoch need a deterministic order; the wrong order leaves a ghost member, resurrects a removed leaf, hides which racing KeyPackage won, or aborts a commit on a duplicate remove. apply_concurrent sorts the proposal set by the (priority, leaf, hash_id) triple — Updates → Removes → Adds, ties by leaf then hash id ascending — rejects an exact duplicate sort key up front (caller canonicalisation bug), then applies each proposal against the intermediate membership:

• Update: leaf must be a member (else UpdateNonMember(leaf)), recorded in updated;
• Remove: leaf must be a member (else RemoveNonMember(leaf)), dropped from membership, recorded in removed;
• Add: leaf must be absent (else AddExisting(leaf)), inserted, recorded in added.

Carried as the D5 verdict with every payload field: the error leaf, and on success the whole MembershipDelta by value — the three lists in canonical application order and the final membership (fixed capacities + lengths; the BTreeSet semantics read through a set-membership helper in tests, exactly the W2 by-value-verdict precedent).

Adaptations (t27 conventions): the original's stable sort → selection sort over a local copy ordered by a lexicographic before-probe (same permutation; the tie key makes the order total); BTreeSet members → fixed array + length (contains = scan, insert = append, remove = shift-left compaction); proposal enum → kind enum + one record form. The original's tenth test pinned the priority constants alone — those fold at compile time in the reference path, so the port pins the gate live (WPS-10 precedent); 0 vacuous.

All 10 original CAR tests transcribed with exact asserts (ghost, resurrection, duplicate add/remove, self-remove-with-update, empty set, determinism, tie-break, duplicate key), plus 4 helper tests and a rule-order test (15 total).

Checks (conventions 0-14): t27b test 15 passed 0 failed, 0 blockers; t27c test-report 15/15, 0 vacuous; gen-rust output compiles under rustc (0 'static str, 0 Vec<const); coverage Untested 0; ASCII only; seal saved, all hashes MATCH; ledger row added to docs/reports/t27b_expectations.json.

Refs #8883

[dmitrii-f-t27]

All required checks green (validate, check-linked-issue, parse-ratchet, t27b-native-linux, t27b-native-macos); cli-tri / duplicate-bodies / t27b-native-ratchet are the known non-required reds. Steward READY. Fourth CR-CHAT-03 target (4/47 T-PORT) — requesting owner merge when convenient, Refs #8883.

[dmitrii-f-t27]

Superseded by #10175: the remaining CR-CHAT targets now land as one port-wave batch per specs/policy/pr_budget.t27 (#10067/#10074), which asks for one PR per ring batch instead of one per file. The spec body, seal and ledger row in this PR are unchanged there; the batch also carries one self-consistent duplicate-body bless. Closing this one-file PR keeps the merge queue and the Actions queue small.