upgrade gitsheets 1.4.1 → 2.x (Rust core), pairing with upstream per-sheet refresh (gitsheets#184)

[themightychris]

The API is pinned to `gitsheets ^1.4.1` — a full major version behind the 2.x line, which replaced the JS engine with a Rust core (canonical TOML, schema validation, and tree ops all native; measured ~4–5× faster on large-sheet commit workloads, with byte-identical output). A migration guide ships with 2.x.

Beyond the version bump, the upgrade is the right moment to retire three workarounds that all trace to the stale-`Sheet`-cache gap tracked upstream as JarvusInnovations/gitsheets#184:

• `apps/api/src/store/store.ts` — `swapPublic()` and the funnel-all-reads-through-memory rule exist because direct `sheet.query*()` after a transact reads the pre-commit tree (documented in `specs/behaviors/storage.md` under "Direct gitsheets reads after a transact").
• `apps/api/src/routes/attachments.ts` — deliberately bypasses `Sheet.getAttachment()` and streams via raw `git cat-file` to dodge the same cache.
• `apps/api/src/lib/data-repo-lock.ts` — a parallel mutex because gitsheets' internal one isn't exposed for non-transact git ops.

Ideally the upgrade lands alongside (or drives) the upstream #184 implementation so those can be deleted rather than ported.

Also worth checking during the upgrade: the `asValidator()` cast in `apps/api/src/store/public.ts` (Zod v4 vs `StandardSchemaResult` structural mismatch) and the `BlobObject.write(hologit, buf as unknown as string)` casts (`importer.ts`, `people.ts`) — the 2.x API surface (`BlobHandle`, typed error classes) may eliminate both.

[themightychris]

Version bump — done (PR #151, merged to develop)

gitsheets ^1.4.1 → ^2.2.0 is merged. Full api suite 423/423 green under 2.x; CI green (the native @gitsheets/core-napi Rust addon has a Linux-x64 prebuild, so ubuntu CI runs the suite cleanly).

What it took (2.x is a "no public-API change" engine rewrite, so this was small):

• Migrated the avatar/media blob-write path off the dropped hologit dep → 2.x repo.writeBlob() → BlobHandle + setAttachments (routes/people.ts, import-laddr/importer.ts).
• Undocumented breaking change found + fixed: 2.x's Rust core throws when marshalling a null/undefined-valued field (1.4.1 silently dropped them). Our .nullable().optional() schemas + ?? null write paths hit this on every cleared-field write. Fixed with a stripNullish at the single validator write-boundary in store/public.ts — output stays byte-identical to 1.4.1. (Worth noting upstream — it's not in the 2.x docs.)
• Byte re-baseline confirmed lossless: integer underscores drop (31_618 → 31618); no test asserted the old bytes.

The three cache workarounds (swapPublic, attachments git cat-file, data-repo-lock) were kept, not deleted.

Remaining (this issue stays open)

• Retire the 3 workarounds — blocked on upstream gitsheets#184 (per-sheet refresh API), which is open and not in 2.x. This is the "pairing with #184" half of this issue; it waits on #184 landing upstream.
• Data-repo re-normalization — one deliberate commit re-serializing all codeforphilly-data records to the new canonical form (drops integer underscores). Until then records re-normalize as they're individually written (mixed formatting in the interim). Best bundled with cutover data prep.