Home format guard #308

Add a format version for the whole home (the local installation directory). A new midenup then either upgrades the home safely or refuses before changing anything, and older releases that know the guard refuse homes they can't read. See section 3 of this comment.

Changes:

• home-format.json with a format number, written by the first midenup release that reads the v3 manifest.
• Check the format on every entry point, before migration, state decoding or recovery; refuse unknown formats without changes.
• Shared/exclusive format lease, taken before HomeLock.
• Whole-plan preflight for conversions before any change.
• Commit point and forward recovery for interrupted conversions.
• Conversions keep installed tools usable, without fetching the manifest or rebuilding anything.
• A leftover legacy file beside valid state doesn't block or overwrite the home.
• Refusal message with clean-install instructions for a separate home.
• Adapters for v1.0.0–v1.2.1 homes.
• Alpha-era homes: refuse with guidance instead of running migrate_v1 at startup.
• Tests for interruption at the commit point, concurrent commands, and two installed midenup binaries.

Open questions:

• Is a conversion journal needed, given that today's conversions can be re-run from any point where they were interrupted? Or should we follow the existing publication journal design?