Ask the repository that owns the path, and pin the wirings that had no test

Round four of the independent review found seven record and coverage
defects. The functional side it verified by running; these are the fixes.

- `_tracked` asked the current checkout's index, so a reviewer in a worktree
  pointing at the main checkout's committed report was told it was untracked.
  It now asks the repository that owns the path, and the guard no longer
  compares directories: any tracked file is committed evidence.
- `retrieval.py` claimed the dense index "catches up inside search". It does
  not: `_stale` is only used by `sync()` and `stats()`, so a store upgraded
  from v11 ranks an empty dense leg until `ely-eye build-dense-index` runs.
  The docstring now states that, and `doctor` already names it.
- Four wirings had no discriminating test, each proven by mutation:
  a stubbed `_tracked` (now a test uses the real git index), `copy_store`
  claiming the scratch (now a live holder blocks the copy before a byte is
  copied), `_stale` reading the atoms table (now a closed memory that loses
  its vector is owed one), and the v10/v11 to v12 `DROP VIEW` gate (now a
  hand-made v11 store is upgraded and its view body re-checked).
- The record corrected against the reviewer's measurements: the five
  mutations did not each turn one test red (M1 turned two, M3 turned two,
  `_stale` alone turned none), the pyright/mypy file set was wrong, and the
  round added seven tests rather than three.

Gates: 422 passed; ruff clean; filesize clean; audit clean; mypy 24 errors in
9 files repo-wide, equal to the 9cb46c1 baseline; pyright 0 on the nine
touched files; zero whole-line comment blocks over 157 tracked files.

bench/tests/test_scratch.py

@@ -29,3 +29,18 @@ def test_one_run_may_copy_more_than_once(tmp_path: Path) -> None:
     scratch.claim(tmp_path)
     scratch.claim(tmp_path)
     assert (tmp_path / scratch.HELD).read_text(encoding="utf-8") == str(os.getpid())
+
+
+def test_copy_store_claims_the_copy_it_makes(tmp_path: Path) -> None:
+    """The claim lives inside `copy_store`, so a harness cannot step on a live run by forgetting to call `claim`."""
+    if not Path("/proc/1").exists():
+        pytest.skip("liveness is read from /proc")
+    source = tmp_path / "source"
+    (source / "data").mkdir(parents=True)
+    (source / "data" / "ely_eye.sqlite").write_text("store", encoding="utf-8")
+    busy = tmp_path / "scratch"
+    busy.mkdir()
+    (busy / scratch.HELD).write_text("1", encoding="utf-8")
+    with pytest.raises(SystemExit, match="is held by pid 1"):
+        scratch.copy_store(source, busy)
+    assert not (busy / "data").exists(), "the refusal must come before a byte is copied"