test(session-store): investigate snapshot fs-verity sealing refusal

[VerifiedOrganic]

The Root-cgroup egress fence job for PR #801 at head 4db9004a128f057c4b1e7f1f11b19af655a51b47 failed consensus::storage::tests::sequential_wal_snapshot_source_and_cache_races_preserve_exact_ownership while enabling snapshot fs-verity. The returned error reports enable errno=Some(26) at consensus/storage.rs:12424. Its store test group completed with 1674 passed, one failed and seven ignored; the later eBPF stages were not run after that failure.

The earlier injected foreign-write cases in the same test emitted their expected validation failures. The terminal failure occurred at snapshot sealing, a separate boundary. It must not be labelled a retained-configuration, request-recovery or root-cgroup attachment defect without further evidence. The original raw log is retained (SHA-256 4143d483f2c6587f565c279f3bc95fde27e09194de21d808537acbd35b4a3cdf).

The complete consensus/storage.rs, fs-verity wrapper and egress workflow bytes match the prior main, this candidate and later main 82027e46d8706bc11f226fbfaf95da7858be7e4c. Source equality does not establish the runtime cause, and a passing run must not be described as a repair.

Investigate with synthetic files and preserved ownership evidence:

• Reproduce the sealing boundary through the actual snapshot builder and identify whether an owned writer remains live when protection is requested. Capture bounded stage/outcome evidence without private file or identity values.
• Distinguish a production ownership defect, a fixture lifetime defect and unproven execution interference using explicit ownership/retirement controls rather than timing assumptions.
• Preserve the original failing evidence and all foreign-write, exact-source, replacement, descriptor, fencing and fs-verity checks. Do not weaken required protection, retry an unclassified mutation, add sleeps or widen existing deadlines to obtain a pass.
• Any proposed correction needs a deterministic pre-fix detector, fix-removal and distinct adversarial negative controls, followed by the focused builder tests and ordinary repository gates on the exact final candidate.

This issue records an observed qualification failure with an unestablished cause. Native WAL and explicit Durable/Async semantics remain unchanged. The separate namespace-key admission contract is tracked in issue #808.