feat(canary): package scaffolding (base/factory/paths/storage) + tests

Mirrors the decnet.intel layout (base + factory + lazy concrete
imports). Defines:

- CanaryArtifact / CanaryContext dataclasses + the generator and
  instrumenter ABCs they share
- factory dispatch for generators (git_config/env_file/ssh_key/
  aws_creds/honeydoc) and instrumenters (docx/xlsx/pdf/html/image/
  plain/passthrough), plus pick_instrumenter_for_mime() for MIME-driven
  dispatch on operator uploads
- persona-aware default placement paths (Linux vs. Windows-shaped)
  and absolute-path validation that the API will use to validate
  operator-supplied placement_path values
- on-disk blob store: sha256-keyed two-level fan-out, idempotent
  writes, refcount-aware unlink (the DB row is the source of truth)

Also covers prior commits' tests (bus topics, models, repo CRUD)
under tests/canary/. 79 tests, all pass.

tests/canary/test_topics.py

@@ -0,0 +1,42 @@
+"""Coverage for the canary bus-topic builder + constants.
+
+The builder shares :func:`_reject_tokens` with every other family in
+:mod:`decnet.bus.topics`, so we only need to exercise the canary
+surface: the three leaf constants and that bogus segments are
+rejected. Anything more would duplicate :mod:`tests.bus.test_topics`.
+"""
+from __future__ import annotations
+
+import pytest
+
+from decnet.bus import topics
+
+
+def test_canary_constants_are_distinct() -> None:
+    assert topics.CANARY == "canary"
+    assert topics.CANARY_PLACED == "placed"
+    assert topics.CANARY_TRIGGERED == "triggered"
+    assert topics.CANARY_REVOKED == "revoked"
+    assert len({
+        topics.CANARY_PLACED,
+        topics.CANARY_TRIGGERED,
+        topics.CANARY_REVOKED,
+    }) == 3
+
+
+def test_canary_builder_round_trip() -> None:
+    assert topics.canary("abc-123", topics.CANARY_TRIGGERED) == "canary.abc-123.triggered"
+    assert topics.canary("xyz", topics.CANARY_PLACED) == "canary.xyz.placed"
+    assert topics.canary("xyz", topics.CANARY_REVOKED) == "canary.xyz.revoked"
+
+
+@pytest.mark.parametrize("bogus_id", ["", "with.dot", "with*wildcard", "with>chevron", "with space"])
+def test_canary_builder_rejects_bad_token_id(bogus_id: str) -> None:
+    with pytest.raises(ValueError):
+        topics.canary(bogus_id, topics.CANARY_TRIGGERED)
+
+
+@pytest.mark.parametrize("bogus_event", ["", "x.y", "*", ">"])
+def test_canary_builder_rejects_bad_event(bogus_event: str) -> None:
+    with pytest.raises(ValueError):
+        topics.canary("good_id", bogus_event)