Store, validated types, bounded pipeline, no-clobber extraction

The store reads and writes the Go on-disk format (it opens the oracle's
fixture vault). Object I/O runs on one bounded worker pool with eight
reusable cleared buffers; sequential and parallel runs produce identical
bytes under seeded test randomness. Extraction publishes with
RENAME_NOREPLACE/link and only after full authentication; failed or
after-publish writes keep crash-safe ordering.

Co-Authored-By: Claude <noreply@anthropic.com>

src/lib.rs

@@ -7,8 +7,11 @@
 #![deny(unsafe_op_in_unsafe_fn)]
 
 pub mod crypto;
+pub mod error;
 pub mod keyfile;
+pub mod pipeline;
 pub mod platform;
 pub mod rng;
 pub mod secret;
+pub mod store;
 pub mod util;