Add isolated permissioned addressing, declarations, LtHash, signedCommit, pure write and oplog transitions, two-root CAR snapshot validation, credentials/DPoP claims, permission resources, and conformance coverage. Preserve ordinary repository APIs and leave the Spren dependency pin for the post-Task-A merge gate. Epic: SPREN-4 Task: SPREN-6