#3364 Datastore rework Phase 4 E/G: a writable datastore-wide control plane so the v3 writer lease binds at the bucket root

Background

swamp-club#3359 (datastore rework Phase 4 C) replaces the v3 writer lock with a fenced writer lease. The lease's records are create-only keys under _control/writer/ (fence-<n> taken with putIfAbsent, plus a heartbeat and a released marker). It runs over the AtomicControlPlaneStore narrowing of ControlPlaneStore. #3359 binds it on filesystem datastores and tests it on the in-memory remote's control plane. On S3, GCS and extension datastores it is not wired yet; that is Phase 4 E and G (tracking: swamp-club#2865).

The gap

There is one commits.db, and so one writer lease, per datastore, not per namespace. Two things stop the lease binding at the datastore root on buckets today:

1. No writable control plane covers the whole datastore. The only one is DatastoreControlPlaneStore (src/domain/datastore/control_plane_store.ts), and it is read-only (get). A sync service's controlPlaneStore() binds a namespace lazily on its first call.
2. Namespaced pushes move root _control/* records. On a namespaced push, when a namespaced v2 index exists, the S3 and GCS extensions move every root _control/* record into <namespace>/_control/ (design/enablers/datastores.md, around line 608). Serve also copies root prefixes into the namespace. A fence key moved under a live writer would look like a lost lease, or let a second writer take a fence that is already in use.

What is needed

• A provider method, or a widened DatastoreControlPlaneStore, that offers putIfAbsent, put, get, delete and list at the datastore-wide _control/ root, with a conformance suite in packages/testing/ (create-only races, a record left unchanged when a create is refused).
• _control/writer/ excluded from the root-to-namespace migration, in the extensions and in serve.
• The S3 and GCS extensions implementing the new method (G).

Acceptance

• On S3 and GCS, the lease's records live at _control/writer/ at the datastore root, whatever namespace a checkout uses.
• A namespaced push never moves or copies them.
• The control-plane conformance suite covers the datastore-wide writer.