ControllerCanonicalWriter

Installed once with the controller. The actual canonical effect executes while its gate is held, after the exact write intent was forced. apply must perform an idempotent durable CAS from priorDigest to payload; after an unknown result it must recognize the already-written identical effect. verify rechecks the retained immutable effect proof after restart, even if newer writes superseded its current pointer. No arbitrary per-call closure can substitute another writer or bypass the guard.