Enforce notification scope-state storage guards

[SadPossum]

Summary

• enforce provider-native scope-state insertion at revision 1, exact one-step revision advances, immutable scope identity, and DELETE rejection
• preserve terminal closed-state immutability and exact prior behavior on migration rollback
• add PostgreSQL and SQL Server upgrade/down/re-upgrade coverage, adversarial multi-row transitions, SQL Server key permutations and mixed MERGE, valid close, and EF concurrency rebase proof
• document the module-local storage invariant without implying protection from privileged schema operations

Validation

• pwsh -NoProfile -File eng/verify.ps1
  • solution sync and module boundaries
  • zero-warning build
  • PostgreSQL and SQL Server migration drift
  • 130/130 non-Docker tests
  • 11/11 Docker integration tests
  • transitive vulnerable-package audit
• pwsh -NoProfile -File eng/check-repository-security.ps1
• pwsh -NoProfile -File eng/check-repository-release.ps1
• targeted whitespace/encoding verification for every changed C# file
• independent exact-diff review: no remaining P0/P1/P2 findings