feat(sync): reconcile stale peer-received rows (#1209)

## Description
Adds receiver-side stale peer row reconciliation for the 0.34 cleanup stack. The reconciler compares peer-received rows against current local Space authorization and deletes only rows that are unambiguously stale. Local/source-owned rows, missing provenance, missing import keys, missing scope metadata, and unknown authorization states are retained with diagnostics instead of being deleted. Sync apply paths now run reconciliation after inbound ops and include reconciled deletes in vector cleanup work.

## Type of Change

- [x] 🚀 Feature (new functionality)
- [ ] 🐛 Bug fix (fixes an issue)
- [ ] 📚 Documentation (docs-only change)
- [ ] 🔧 Maintenance (refactor, chore, CI, etc.)
- [ ] 🧪 Testing (test-only changes)

## Testing

- [x] Relevant checks pass locally (`pnpm run tsc`, `pnpm run lint`, `pnpm run test`)
- [x] Added/updated tests for changes
- [ ] Manually verified changes work as expected

Additional checks:
- `pnpm exec vitest run packages/core/src/sync-replication.test.ts packages/core/src/sync-pass.test.ts`
- `pnpm run check`

## Checklist

- [x] Code follows project style (`pnpm run lint` passes for touched files)
- [x] Self-review completed
- [x] Documentation updated (covered by existing 0.34 cleanup plan)
- [x] No new warnings introduced