Changes touching this path

• a retired namespace key no longer reads its own repo on the sync surface: AccessClass::of still asks about the owner pubkey first, and now asks account_of about it once, answering no row or a live row Member and a retired row Anon, which is the require_pusher answer for the same key, so a leaked retired namespace key stops pulling the Internal tier. the owner arm gives up its zero-read property, and ADR 0077 decision 3 is amended with the cost, one account_of read on every sync read the owner pubkey signs, accountless owners included, as the correction on the ticket restated the done bar, and with why no per-request cache is needed. new model.rs tests pin the retired namespace key reading Anon and, through a counting store, the reads each branch costs, where the owner pubkey cells moved from none to one and the accountless owner asks account_of once, about itself; a new server.rs test asserts that over the #927 cast every signer the read rule admits as owner may push; member_class.rs now asserts the retired namespace key reads Anon against Postgres, with a live namespace key on a new repo as the owner control. before the change the in-memory selection went red (17 passed, 3 failed) and member_class against a throwaway cluster went red (2 passed, 1 failed), and so did the arm with retirement ignored (18 passed, 2 failed; 2 passed, 1 failed), with a missing row read as Anon (14 passed, 6 failed; 2 passed, 1 failed) and with a second owner read (19 passed, 1 failed). the serve.rs cost double now delegates account_of, CONTEXT.md and store.rs state the rule, the workspace suite is green, and the loot-forge suite is green against a throwaway cluster with the CI env block and LOOT_FORGE_TEST_REQUIRE_DATABASE (#1955) 1ef40df6 · dbf3dbe6…

Renames are not followed. loot's tree maps a path to an address, so a rename is a delete and an add. This list is the history of the name, not of the bytes.