roots: add git-ents, the local and single-node hosted composition roots

git-ents is the CLI-complete milestone: two composition roots (LocalRoot, HostedRoot) wire RefStore/odb/EventSink/Executor per roots.local, above a cli.rs/exe.rs split (figue derive definitions vs. dispatch) and a commands/ module per porcelain family (setup, members, account, effect, toolchain, comment, inbox, redact). mutate.rs is the one shared primitive every write command uses to build, sign, and propose a typed-tree mutation through ents_receive::receive; sign.rs is the real SSH signer counterpart to ents-testutil’s fixture Keypair, since the redone architecture builds and signs commits in-process rather than shelling to git commit -S the way pre-redo’s CLI did.

HostedRoot doubles as the single-node hosted root the development plan describes: stock git’s own receive-pack stays the transport, with hook.rs’s pre-receive/post-receive plumbing running the identical ents_gate::verify every other call site uses and reconciling effect obligations from repository state alone (receive.reconstructible) - deliberately not ents_receive::receive’s own RefStore::transaction path, since that would race git’s native ref update in this deployment shape (see hook.rs’s own doc). QuarantineObjects chains a pre-receive quarantine directory in front of the real odb in-process, rather than writing a physical info/alternates file: that first attempt was briefly tried and reverted after it surfaced a real bug - git’s quarantine finalization moves the quarantine directory’s contents, including anything a hook wrote into it, onto the real object directory, permanently self-referencing objects/info/alternates and failing every later push.

setup.rs also closes roots.worktree-update: git ents setup sets receive.denyCurrentBranch=updateInstead via a git config subprocess, since gix’s own config-snapshot API has no file-persistence path at all (confirmed empirically - SnapshotMut::commit only updates the in-memory resolved view a Repository handle holds).

New dependencies: ssh-key + rand_core (real, non-fixture SSH signing and key generation) and uuid (comment ids) - all added to git-ents only. ents-anchor and ents-effect move from members-only to workspace.dependencies, since this is their first consumer.

Assisted-by: Claude:claude-sonnet-4-6