#9 Adopt common-auth 0.38.0 limits envelope handling

Moves to common-auth ^0.38.0. The limits namespace now uses canonicalLimitsPath, so a roster reached through a symlinked or aliased folder gets the same namespace; an old resolved-path record is replaced once on the next save. A record the shared adapters reject (repeated conflict or unsupported schema), or a registry that abandons itself after startup, now means no limits tracking for that store for the rest of the process: requests are served with no limit marks, with one log line, and are never refused because of limits. Real OpenCode 1 (15), OpenCode 2 (8) and Pi (46) suites passed on Linux.

---

Summary by cubic

Upgrades to @cortexkit/common-auth 0.38.0 and reworks limits envelope handling.

Behavior changes

• Limits namespaces now use canonicalLimitsPath, so a store reached through a symlink or alias shares one namespace; an old resolved-path record is replaced once on the next save.
• When the shared adapters reject the envelope (repeated conflict or unsupported schema) or the registry abandons itself after startup, limits tracking is disabled for that store for the rest of the process.
• Disabled stores serve requests without limit marks, emit one log line, and are never refused because of limits.

Tests

• Adds regression tests for serving, repair, acquisition, abandonment, and aliased paths; the aliased-path test is skipped on Windows.
• OpenCode 1, OpenCode 2, and Pi suites pass on Linux.