store: source retirement follow-ups (tracking) #829

Umbrella for the three follow-ups filed on 2026-09-21 after the verified-path source retirement landed (#806, #807).

• store: store forget can delete the family store while a link retires into it #809 (bug, P1): store forget can delete the family store while a link retires into it; a reachable data-loss window.
• store: refuse writes into a store retired by --retire-source #808: refuse writes into a store retired by --retire-source (needs a store identity outside the deletable root, or a revalidation protocol).
• store: recover content a --retire-source run cannot fold #810: opt-in recovery for content a retire cannot fold; store link should stop silently skipping content-only stores.

All three belong with the authority-guard work in authority_lock.rs / event_store.rs; #796 (storage-model.md still says there is no store-directory lock) should be written alongside.

The sub-issues carry the acceptance criteria; this issue carries no priority of its own.