fix(format-v3): harden system binding against replay and bypass attacks (F-01, F-02, F-03)

- F-02: Require restore_nonce token and explicit confirmation (--rebuild-mac) for PendingRebuild
- F-01: Extend canonical MAC transcript to include chunk generation tuples (node_id, chunk_index, generation) and support transparent legacy migration
- F-03: Make V2-to-V3 container upgrade atomic with transactional rollback and dual-slot version update
- Bump version to 0.9.4 and update changelog and security docs

tests/mount_security_test.rs

@@ -375,6 +375,7 @@ async fn test_mount_rejects_tampered_metadata_mac() {
         false,
         None,
         true,
+        false,
     )
     .await;
 
@@ -472,6 +473,7 @@ async fn test_mount_succeeds_and_rebuilds_mac_after_header_file_restore() {
             false,
             None,
             true,
+            true,
         )
         .await
     });
@@ -577,6 +579,7 @@ async fn test_mount_succeeds_after_recovery_key_restore_slot0() {
             false,
             None,
             true,
+            false,
         )
         .await
     });