[guofoo]

Lets a host persist a Card's L0 instance state across restarts.

• InstanceStore::snapshot_bytes() writes a versioned (schema: 1) JSON snapshot of the cells, their value origins, schemas and shapes.
• InstanceStore::from_snapshot_bytes() reads only that schema and refuses unknown fields.
• Both sides enforce the same bounds: 1 MiB total, 1,024 instances, 8,192 fields, 128 schemas/shapes, 256-byte keys and field names, 4 KiB shapes.
• ValueOrigin serialises in snake_case so a restored user_input cell keeps its origin.
• The bytes are meant for a host-owned directory: origins are trusted metadata, never app input. The next realization still reconciles component schema and prunes cells that are no longer live.

octoscript-ui-l0 gains a serde dependency (derive). serde_json was already a dependency; the arbitrary_precision guard for octoscript-schema/-capabilities/-workflow is unaffected.

Consumers: the Card event runtime (OctoSense-org/OctoScript-Makepad#62) locks 76032ed4 on this branch, and App Hub's store foundations use it to restore Card state.

Checked locally on 76032ed4:

• cargo fmt --check, cargo clippy --workspace --all-targets --all-features -- -D warnings: clean
• cargo test --workspace --all-features: 1302 passed, 0 failed (including tests/state_snapshot.rs)
• cargo test -p octoscript-schema -p octoscript-capabilities -p octoscript-workflow and the arbitrary_precision tree check: pass
• Head 0fa8693 adds only the serde line to fuzz/Cargo.lock, which the first CI run caught: RUSTFLAGS='--cfg fuzzing' cargo +nightly check --locked --manifest-path fuzz/Cargo.toml and the fuzz fmt --check now pass locally
• Not run locally: the fuzz and miri runs themselves, and the cross-target sandbox checks.

Merge with a merge commit so 76032ed4 stays on main for the runtime's lock.