Capability quotas, CAS gc, patrones burst/silence, snapshot incremental

- quota_for_capability(cap) tabla por variante: Spawn 2, FilesystemRoot 2,
  Endpoint 16, Journal 32. mediate_capability rechaza con QuotaExceeded
  si holder ya tiene N tokens activos.
- ente_cas::list_all_shas() + gc(reachable). audit::reachable_from_head()
  walks la cadena. Endpoint GcCas con extra_roots para Wasm SHAs.
  brainctl gc-cas.
- PatternCrystal::Burst (kind, count, freq_hz) y Silence (kind, since_secs).
  detect_pattern_crystals + endpoint PatternCrystals + brainctl patterns.
- Observer.dirty_marginal/dirty_cooccur tracking. snapshot() marca
  consumo (clears dirty); snapshot_delta() emite sólo lo cambiado.
  apply_delta() merges incremental sobre estado existente. Útil para
  checkpoints frecuentes con poco overhead.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

crates/ente-brain/examples/brainctl.rs

@@ -62,6 +62,8 @@ async fn main() -> anyhow::Result<()> {
         "flush-audit" => IntrospectRequest::FlushAudit,
         "audit-verify" | "verify" => IntrospectRequest::VerifyAudit,
         "replay" => IntrospectRequest::ReplayAudit,
+        "gc-cas" => IntrospectRequest::GcCas { extra_roots: Vec::new() },
+        "patterns" => IntrospectRequest::PatternCrystals,
         "reload" => {
             let path = args.get(2).cloned();
             IntrospectRequest::ReloadRules { path }
@@ -158,6 +160,22 @@ fn print_response(r: &IntrospectResponse) {
                 if let Some(g) = rep.genesis_sha { println!("  genesis: {}", hex_long(g)); }
             }
         }
+        IntrospectResponse::Patterns(ps) => {
+            println!("{} cristales pattern detectados:", ps.len());
+            for p in ps {
+                match p {
+                    ente_brain::crystallize::PatternCrystal::Burst { kind, count, frequency_per_sec } => {
+                        println!("  burst: {kind:?}  count={count}  freq={frequency_per_sec:.2} Hz");
+                    }
+                    ente_brain::crystallize::PatternCrystal::Silence { kind, last_count, since_secs } => {
+                        println!("  silence: {kind:?}  last_count={last_count}  ausente={since_secs:.1}s");
+                    }
+                }
+            }
+        }
+        IntrospectResponse::GcResult { deleted, freed_bytes } => {
+            println!("CAS gc: {deleted} blobs eliminados, {freed_bytes} bytes liberados");
+        }
         IntrospectResponse::AuditStreamFrame(_) => {
             // En modo request/response no debería llegar; solo aparece en
             // run_stream_audit. Si llega aquí es un bug del servidor.