feat(go): durable transaction engine and Kiro IDE 1.0 adapter

Split the monolithic transaction into focused modules: append-only
crash-recoverable journal under ~/.elydora/transactions with owner
tokens and per-transaction namespaces, staged atomic publication
(stage .pending, fsync, rename, fsync), platform-specific atomic
replacement (MoveFileEx, renameat2, renamex_np), private-directory
hardening per OS, lock-guarded recovery, and workspace cleanup that
removes only transaction-created empty directories.

Add the Kiro IDE 1.0 plugin: strict v1 hook schema with one enabled
PreToolUse guard and PostToolUse audit pair bound to the active
workspace, agent-to-workspace identity binding in runtime config, and
exact migration of the legacy elydora-audit.kiro.hook contract.

Gates: go test ./... and -race pass, go vet clean, govulncheck reports
zero reachable vulnerabilities, git diff --check clean.

cmd/elydora/plugins/transaction_atomic_unix.go

@@ -0,0 +1,18 @@
+//go:build linux || darwin
+
+package plugins
+
+import (
+	"errors"
+	"path/filepath"
+)
+
+func syncAtomicRenameDirectories(source, destination string) error {
+	sourceDirectory := filepath.Dir(source)
+	destinationDirectory := filepath.Dir(destination)
+	destinationErr := syncTransactionDirectory(destinationDirectory)
+	if durablePathKey(sourceDirectory) == durablePathKey(destinationDirectory) {
+		return destinationErr
+	}
+	return errors.Join(destinationErr, syncTransactionDirectory(sourceDirectory))
+}