[0.2.0 lifecycle] Add model-based revision, save, cancellation, recovery, and rollback tests

[mberrys]

Problem
Unit tests cover individual components, but the expensive regressions happen across sequences: edit while preflight runs, cancel during save, crash after an output rename, recover then rollback, or reuse a stale result after revision change. Example-only tests cannot cover the state-space reliably.
State model

enum class ModelCommand
{
    Open,
    Edit,
    StartPreflight,
    CancelJob,
    SaveIncremental,
    SaveAsNewArtifact,
    Crash,
    Recover,
    Rollback
};

struct ModelState
{
    QByteArray sourceDigest;
    quint64 revision = 0;
    bool jobRunning = false;
    bool candidateApproved = false;
    QVector<QByteArray> provenanceHashes;
};

Generate deterministic command sequences and assert invariants after every transition:

• source digest never changes;
• revision is monotonic;
• stale results never become current;
• cancelled work never reports success;
• provenance only appends;
• rollback creates a new revision;
• unapproved/recovered output is never certified;
• save policy matches operation requirements.
  Acceptance criteria
• Deterministic seed replay is supported.
• Failing sequences shrink to a minimal reproducer.
• Windows and Linux run the same model corpus.
• At least one deliberately injected stale-result, overwrite, and rollback-history defect is caught.
• Regression sequences can be promoted into named fixtures.
  Dependencies: [0.2.0 trust-contract] DocumentContext as the single revision authority for caches and async results #236–[0.3.0-A] Make save mode an explicit policy declared by the operation #239, [0.2.0 resource-envelope] Add a resource-exhaustion corpus asserting budgets report the correct reason #243.