[New1Direction]

Clean integration of the tested #18 snapshot feature

Original stacked PR #18 depends on a now-superseded branch. Ported the same bounded, opt-in snapshot code onto the current main after merged #26, preserving the loopback control-room security checks.

Changes

• Optional --snapshot-dir writes strictly bounded, SHA-256-verified graph metadata to a private 0700 server-side directory/0600 SQLite database, retaining up to eight versions per repository.
• Restart restores the last source-pinned graph STALE_LAST_KNOWN until the next successful discovery; no stale data is presented as live health.
• Atomic version/head updates, retention, corruption refusal, symlink and permission checks, no raw manifest or credential storage.
• Existing repo.ing read-only smoke now tests persistence and simulated offline recovery.

Safety

Local, single-operator and opt-in only. The SQLite file is not application-encrypted; an encrypted host volume is required for stronger at-rest protection. No multi-tenant hosting, no backup claims, no production writes or service deployment.

Gate

Merge only after Python 3.11/3.13 Validator plus actual repo.ing source/recovery smoke pass. Keep old PR #18 branch for downstream draft ancestry.