For 2f9a353: prove planner/activity dedup splits on schema_ref so the
same content_hash under a different schema ref doesn't collapse rows.

For 1726fa1: cover the new trait surface — list_kinds reports distinct
(kind, node_label) pairs, get(kind, ref) returns typed payloads,
delete_before is scoped to one kind. FilesystemStore tests pin the
schema-only behavior: planner/activity put/get return the unsupported
error; list of non-schema kinds returns empty.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Eight tests against the bundled FilesystemStore: round-trip of all
three kinds, planner orphan rejection, planner/activity dedup,
per-node activity upsert, kind-filtered list, list_kinds enumerating
node labels, and delete_before semantics for planner (clear field,
keep schema) vs schema (remove bundle).

Lock in the two recent FilesystemStore fixes with direct unit tests:
read_bundle must reject byte-flipped or filename-spoofed bundles, and
concurrent put_schema with the same hash must converge on a single
file with no .tmp stragglers.

Co-Authored-By: Claude <noreply@anthropic.com>

The "TODO: remove in about month time" fallback in read_bundle is
actually load-bearing: v0.6.1 (and earlier) wrote a bare SchemaSnapshot,
not a Bundle envelope, so pulling from a pre-bundling shared directory
goes through this branch. Drop the TODO, document the real reason, and
add a unit test so the path can't be deleted by accident.

Co-Authored-By: Claude <noreply@anthropic.com>

Docker-based black-box suite for `dryrun snapshot push/pull` against
real Postgres, comparing local HEAD with the v0.6.1 release fetched
via git tag at image build. 10 scenarios cover the happy paths
(UC1/UC2/UC3, round-trip identity), v0.6.1 read compatibility,
filesystem edge cases (corruption detection, read-only mount, stale
.tmp), and concurrent writers (same-hash and different-hash races).

Two run modes:
- ./harness.sh keeps the stack up between invocations (~1.6 s warm).
- ./run-native.sh skips the Docker runner image, building the local
  HEAD binary against a single pg-a (~1.8 s warm). Scenarios that
  need v0.6.1 self-tag with `# NATIVE: skip`.

pg-a/b/c run on tmpfs; runner sleeps infinity so harness.sh can
docker compose exec into it.

Co-Authored-By: Claude <noreply@anthropic.com>