fix(read): resolve retention-retired catalog blocks via local shard inclusions

[frrist]

Catalog retention (runRetention, Retain default 6) deletes shipped segment CARs from disk and DB, but the appliance read tier could not resolve the blocks inside them: LocalLocator answers only whole-blob rows from blob_locations, keyed by a blob's own digest — and a manifest / MST node is an interior slice of a shipped CAR, not a stored blob. Once a bucket rolled past the retain window, any object whose manifest lived only in a retired segment became unreadable: GETs and undelimited listings failed with "blockstore: not found". (Regressed in the phase-7 hardening, which swapped the indexer-backed IndexLocator for LocalLocator; the ship path never stopped publishing the per-block index — the read side just stopped consulting anything that could use it. architecture.md §8's main text had this right; its R0/R1 parenthetical did not.)

Mirror the indexing-service contract locally — locations AND inclusions:

• shard_inclusions (migration 00006): block digest → shard digest + inclusive byte range, one row per block of every shipped catalog CAR.
• The flush path records the shard's blob_locations row and its inclusions BEFORE the segment is marked shipped, so retention can never retire blocks the read tier can't resolve. SubmitShard now returns the shipped CAR's location commitment to make that possible.
• LocalLocator falls through location-miss → inclusion → shard location, emitting the same Location{shard commitment, inner range} shape IndexLocator produces; the ranged /content/retrieve path is unchanged, and an external indexer remains a locator-swap away.

Also fixed en route:

• SubmitShard issued /index/add without the ship proof store, so every catalog index publication went out proofless and was rejected — segments never marked shipped, so retention never ran at all.
• Index publication (index blob + /index/add) is now best-effort: the CAR is durable on piri and local inclusions serve ingot's reads, so an indexer-side failure logs loudly instead of wedging retention. TODO: queue failed publications for retry.
• itest harness boots piri with Postgres (piri:main's Curio PDP pipeline no longer supports sqlite).

TestForgeReadAfterCatalogRetention proves the path end-to-end: roll a bucket past the retain window, verify the early segments physically retire, then GET + undelimited-list objects whose manifests exist only in retired segments. Note: currently red in a full run for an upstream reason — piri cannot verify did:plc-issued proofs (empty verification- method list), which fails ALL hilt-era /content/retrieve; the pre-existing TestForgeReadAfterEviction fails identically on main. This test should go green with no further changes once that piri fix lands.

[alanshaw]

LGTM

[alanshaw]

Both multihash.Multihash?