feat: support vector record IDs across filesystem APIs

[markwhen]

Summary

• centralize deterministic vector record ID generation and migration handling
• allow stat and read to resolve file IDs with actionable missing-index diagnostics
• add selectable filesystem fields and script-friendly ls, tree, and glob output
• preserve complete IDs in simple output and honor tree --simple without fields
• restrict Python SDK ID passthrough to supported read-only endpoints
• preserve explicit empty glob extra_fields for metadata responses
• retain the dedicated Codex OAuth doctor diagnostic path
• preserve upstream ACL filtering and avoid enriching denied directory entries

Compatibility

• URI-based filesystem behavior remains unchanged
• stat may advertise a deterministic file ID before asynchronous indexing completes; ID lookup returns NOT_FOUND with a reason indicating that data may be unindexed or deleted
• glob without extra_fields continues to return URI strings; an explicit empty list returns base metadata objects

Testing

• cargo test -p ov_cli (478 passed)
• pytest doctor, Codex VLM, and Python SDK suites (147 passed)
• pytest VikingFS glob/tree/ACL/record-ID and server endpoint suites (68 passed)
• Ruff checks on changed Python files
• git diff --check

Rebase / conflicts

Rebased onto upstream/main at e357af6. Conflicts with the latest ACL and doctor changes were resolved by preserving asynchronous ACL checks, ACL materialization during URI remapping, batch raw upserts, normalized VLM validation, and the dedicated Codex runtime credential diagnostic.