[beinan]

Summary

Add an independent rollout-ingestion adapter using the durable WAL's TLS client interface. It verifies the authorized table generation and rollout contract at quorum, reserves shared memory before buffering, validates Arrow IPC and session-bucket boundaries, and retains the original bytes for exact retries. Durable ACKs produce authenticated receipts that can be restored after restart and checked against compact publication visibility.

The adapter lives in the unpublished lance-context-ingest crate so the existing publishable core does not acquire an unpublished WAL dependency. Applications must persist producer-open and append retry state before sending; HTTP routing, that journal wiring and the materializer loop remain separate integration work.

Refs #378.

Testing

• Full repository CI-equivalent checks, including Rust, Python, Ruff and Pyright.
• Real TLS three-replica test with a real Lance genesis manifest, all original replica directories restarted, exact retries, and complete metadata/payload reads.
• IPC validation, shared-memory pressure, virtual buckets sharing a Raft group, receipt tampering/key rotation/scope, producer fencing, and compact quorum visibility bounds.

Built on merged #448. The change is now based on main with an identical feature diff; all checks must pass for the new commit before merging.

CI correction: registry packaging excludes the private ingress adapter; its Rust feature tests remain required. Linux wheel setup uses bounded downloads from the official AlmaLinux repositories, with TLS and package signature checks preserved.

APT wheel setup now uses only signed official distribution repositories in an isolated metadata directory. This avoids unrelated PPA outages; bounded network retries, HTTPS and archive signature verification remain enabled. Bash/ShellCheck and a local Debian metadata/install simulation passed; the Ubuntu cross-build installation is validated by remote CI.

CI runs the existing workspace, WAL, Lance, and etcd suites in separate jobs so cold feature builds do not exhaust one shared 60-minute timeout. Every original check command and the coverage jobs are preserved. Checkpoint reopen cases are serialized around subprocess creation to prevent inherited file locks; corruption cases must report the expected validation error. Minimal-feature and all-feature checkpoint tests and Clippy pass; the workflow passes actionlint. Final-commit CI is required before merging.