Ground depot finite loading proposal

Apply fix.patch (five production source paths, two new tests) and independently
reviewed .build/ground-depot-leaf-review-0303/tests.patch (two distinct tests).
No tracked source, index, native process or original reference was changed here.
Working/index preimages and hashes are under baseline/. New paths have null
preimages. source-hashes.json records this proposal. git apply --check passed.

Production contract:
- SiteService retains only exact startup-created OUTPOST magazine identities,
  excludes escape-opening sites and objective-target stock, exposes detached
  lists only after successful readiness; it never adopts later cache deposits.
- One retained HQ controller, one concurrent job, at most96 admitted attempts.
  An existing idle original mobile responder carries one compatible unchanged
  original magazine through two independent native inventory moves.
- Existing infantry/mounted/mine/mortar work runs first. Target admission also
  needs known committed original-magazine expenditure beyond prior depot
  imports. Unknown/deleted spent identities and mine expenditure do not qualify.
  This is conservative attempt-ledger depletion, not an asserted live empty truck.
- Fresh delivered truck position plus a NEW post-hold delivered status is used
  for dispatch. Cache coordinates are own fixed authored knowledge. No players
  queried for task destination, no movement/inventory teleport, no generated stock.
- Original actor/roster/cache/inventory/task/receipt/crew/root and exact tokens
  are revalidated. Authored storage anchors, distance/LOS, actual managers and
  CanMove capacity gate both once-only native calls. Rounds/capacity stay fixed;
  used/loaded magazines cannot be removed.
- Source attempt ledger is global to this one controller and DISTINCT from truck
  outgoing spent. Pickup commits before native call. Second leg retains the same
  committed handle and a one-shot claim. Separate callbacks cannot cross-ack.
- Destination imports append to the exact existing stock array; lifetime96
  includes spent/deleted entries. No eviction, replacement array, refund or refill.
  Continuation validity has no capacity/depletion gate, including95->96 import.
- Return completion requires near camp and >=6m actual porter/truck separation.
  Deadline180s is fixed and additionally bounded by original report age.
- SupplyHeld pauses the entire six-vehicle column. Failed submitted unknown work
  retains both group/truck claims and leaf callback after deadline/Stop; no late
  proof can resume movement or admit new stock. Exact callback/custody proof or
  deletion settles uncertainty. Owner-guarded stopped polling only removes own
  timer and stops on HQ/mode replacement; destructor removes it.

Validation:
- test_ground_depot_loading.py executes actual Plan/Tick/Abort/Stop and
  TransferValid/ClaimDelivery/DeliveredTo plus actual AdmitDepot. Native leaves,
  movement/access and wider original identity validation are boundary doubles;
  a structural check ensures Valid depends on DepotCurrent, not admission gates.
- test_ground_depot_lifecycle.py executes actual HQ Tick/Stop/poll methods.
- Independent test_ground_depot_transfer.py executes actual full native-move
  leaf with callbacks and custody doubles, including inline Stop resurrection
  red-before/green-after and inline owner revocation.
- Independent test_ground_depot_provenance.py executes actual startup capture,
  detached accessors, admission/current/depletion predicates and reservation.

Not qualified by these model tests: native script compilation, exact ordinary
cache/vehicle action anchors, navigation/physical approach reliability, network
inventory callbacks or native successful end-to-end delivery. No engine was run.
This is opportunistic existing camp stock/team access, not a guaranteed warehouse.
Existing source camps may be exhausted, busy, far away or physically inaccessible.