feat(wake): W2 — three-cursor durable store + RECEIVED/CONSUMED ack-wrapper + watch-list schema

Implements W2 of the wake/heartbeat canon (EPIC #892), honoring the
CONVERGED-DESIGN contracts exactly.

A2 store.sh — three-cursor durable queue (§1.2/§2.3/§2.4):
  - observed_seq authoritative monotonic cursor (detector assigns, lib records);
    SHAs are descriptors, not the cursor.
  - durable pending-inbox {observed_seq, locators, class, emit_ts, hmac}; hmac is
    an UNSIGNED placeholder (signing is W3/A5).
  - consumed_seq advances ONLY on a CONSUMED ack over a CONTIGUOUS gapless prefix
    <=N; never on enqueue/exit-0/paste.
  - coalesce: digest REPLACES the pending cumulative-state entry; actionable/human
    APPEND; ALL classes durable (durability never bypassed); absent class => actionable.
  - drain returns the deliverable set; every mutation is atomic write-tmp+rename.

A4 ack.sh — RECEIVED/CONSUMED wrapper (§2.2):
  - RECEIVED dedups DELIVERY via wake_id (dup = re-RECEIVE, never re-action).
  - CONSUMED N local-write-only to the XDG ledger, cumulative, gapless-prefix
    enforced; background sync ships the ack (never blocks on network).
  - `embed` prints the one copy-run line a digest embeds.

Watch-list SCHEMA contract (defaults/wake-watch-list.schema.json) with
schema_version; wake manifest.txt declares component semver + supported schema
range (schema_min/schema_max, Gate B — version metadata only, NOT path ownership).

RED-first shell harness wired into test:framework-shell covers each invariant
(three-cursor, coalesce-vs-append, contiguous-prefix CONSUMED, wake_id dedup,
atomic tmp+rename crash-safety, durability-across-restart, ack-never-blocks-on-net).
shellcheck clean; sanitization gate + operator firewall pass.

Part of #892

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0158NZqN2n2ymKFeJAZ4GUCb

packages/mosaic/framework/tools/wake/manifest.txt

@@ -0,0 +1,29 @@
+# Mosaic wake component — VERSION metadata manifest (Gate B).
+#
+# EPIC #892, W2 of the wake/heartbeat canon.
+#
+# SCOPE — THIS FILE IS VERSION METADATA ONLY. It declares the wake component's
+# semantic version and the RANGE of watch-list schema versions it supports. It
+# does NOT authorize file/path ownership: path-ownership remains the sole domain
+# of packages/mosaic/framework/framework-manifest.txt (Gate A). Do not read any
+# ownership meaning into this file.
+#
+# Format: KEY=VALUE, one per line. '#' and blank lines ignored.
+
+# Component identity + semantic version (the store+drain lib + ack-wrapper).
+component=wake
+version=0.1.0
+
+# Watch-list schema this component consumes, and the INCLUSIVE range of
+# schema_version values it supports. A wake-watch-list.json whose schema_version
+# falls outside [schema_min, schema_max] is rejected by the component (fail-loud),
+# never silently coerced.
+schema=wake-watch-list
+schema_min=1
+schema_max=1
+
+# W2 pieces shipped by this component version (informational):
+#   store.sh   A2 — three-cursor durable store + drain lib.
+#   ack.sh     A4 — RECEIVED/CONSUMED ack-wrapper (local-write + async ship).
+# Out of W2 scope (later waves): detector (W4), digest renderer/HMAC (W3),
+# FN-oracle/reconciler (W5), beacon (W6), installer (W7).