refactor(filesystem): preserve admitted file facts

Return the validated descriptor and its original metadata from regular-file
admission. Propagate that contract through owned reads, hashes, snapshots,
artifact inventory and provider file workflows instead of replacing initial
facts with another stat. Keep arbitrary output-handle operations separate.

Preserve final descriptor/path identity proofs, borrowed-source verification,
BigInt precision, cancellation provenance and failed-close ownership. Remove
the obsolete source and owned-ZIP baseline stages and update their consumers
and regressions. Tie read completion faults to actual reads instead of the
retired duplicate stat; instrument real handles without fake handle wrappers.

Validation: fresh runtime/catalog build; focused source, lifecycle, filesystem,
CLI/MCP and authored provider-fixture tests; full static checks; docs checks;
test discovery; duplication check. Platform-specific cases remain skipped on
macOS. No installed provider or device behavior was verified.

src/javascript/recovery/RecoveryFiles.ts

@@ -65,9 +65,8 @@ const scanRecoveryFile = async (
       path,
       resources ?? new ArtifactResourceScope(),
       signal,
-      async (handle) => {
+      async ({ handle, initial: before }) => {
         const hash = createHash("sha256");
-        const before = await handle.stat();
         if (before.size > maximum)
           throw new RecoveryFileSizeError(
             `Expected a regular file no larger than ${String(maximum)} bytes: ${path}`,