Fix pcf-compact corrupting PFS-MS files; add PFS-aware compaction

[kduma]

Generic PCF compaction (Container::compacted_image) repacks entries into
shared table blocks and rewrites every table_hash. On a PFS-MS file this
destroys the one-PFS_SESSION-per-HEAD invariant and the inter-session
commitments (member_blocks_digest, prev_session_hash), so the result no
longer scans or verifies as PFS-MS:

pfs: broken session chain: HEAD block must hold exactly one PFS_SESSION

Generic content-preserving compaction therefore cannot keep a multi-session
PFS-MS file valid. Two changes address this:

1. PFS-aware compaction (pfs-ms crate): new compact / compact_archive
   resolve the live tree at the head and re-emit it as a single fresh
   session (seq=1, prev_session_hash=0), discarding history per spec
   Section 15 -- deleted nodes are dropped and delta chains collapse to the
   newest full DIRECT content. Exposed as pfs compact <file> [<out>].
   Reuses FsReader/FsWriter/commit_changes; the synthesized root means a
   single commit_changes on a fresh create() yields one valid session.

2. Guard in pcf-compact: refuses an input carrying a PFS_SESSION partition
   (type 0xAAAA0002) and points the user to pfs compact. --allow-pfs
   forces a plain-PCF compaction that intentionally discards PFS structure.

Specs (PFS-MS Section 15, PCF Section 11.5) and READMEs updated to document
that generic PCF compaction MUST NOT be applied to profile-structured files.
Adds tests: single-session round-trip, deleted/delta flattening, metadata
and hash-algo preservation, empty tree, idempotence, corrupt-source
rejection, in-place/separate-output archives, and the pcf-compact guard.

https://claude.ai/code/session_016Xc2k2U7vWCQQUjTPNSRjK