merge: combine the v3 (ann/io/migrate) and v6 (agent/format) mission work

Two missions found largely disjoint ground — v3 in clawhdf5-ann, -io and
-migrate, v6 in -agent and -format — so this merge is mostly additive.

One genuine collision: BOTH runs independently implemented
`Dataset::verify_provenance` in clawhdf5/src/reader.rs, and git kept both,
producing `E0592 duplicate definitions`. They were functionally identical
apart from `self.file.data.as_bytes()` (v3) vs `self.file.as_bytes()` (v6).
Kept v6's — it is the variant that compiles against the current tree and
passed 52 suites, and its doc comment is the more honest one, stating both the
full-read cost and that an unkeyed hash stored beside its data is not a
tamper-evidence guarantee.

Verified present after the merge:
  P1  clawhdf5-ann now depends on clawhdf5-accel; compute_distance calls
      l2_distance / cosine_similarity instead of a scalar loop
  P2  AsyncFileReader caches its handle and length behind a mutex
  PR1 clawhdf5-migrate writes SHINES provenance, and validate checks it
  v6  WAL torn-tail truncation, char-boundary truncate, agent hardening

52 suites pass, 0 failures.

Co-Authored-By: Claude Opus 5 <[email protected]>

crates/clawhdf5/src/reader.rs

@@ -426,22 +426,6 @@ impl<'f> Dataset<'f> {
         Ok(data_read::read_as_strings(&raw, &dt)?)
     }
 
-    /// Verify this dataset's SHINES provenance hash (the `_provenance_sha256`
-    /// attribute written by [`clawhdf5_format::type_builders::DatasetBuilder::with_provenance`])
-    /// against its actual stored bytes.
-    ///
-    /// Returns [`clawhdf5_format::provenance::VerifyResult::NoHash`] if the
-    /// dataset was never written with provenance metadata. Requires the
-    /// `provenance` Cargo feature on `clawhdf5-format` (enabled by default).
-    #[cfg(feature = "provenance")]
-    pub fn verify_provenance(&self) -> Result<clawhdf5_format::provenance::VerifyResult, Error> {
-        Ok(clawhdf5_format::provenance::verify_dataset(
-            self.file.data.as_bytes(),
-            &self.header,
-            self.file.offset_size(),
-            self.file.length_size(),
-        )?)
-    }
 
     // ----- Selection-based read methods -----