Portable export and full-fidelity import #426

Problem

Most groups will start on a community host, and a group's risk can change faster than it can plan. Moving hosts must be lossless, and today it isn't, unless the host cooperates:

• No export or import exists. adapter-json ("Portable JSON files") is listed as planned in adapters.md § Adapter backends.
• A file copy is lossless but needs the host. Copying the SQLite database and the attachments/ directory carries everything, but only someone with the files can do it, and a host on record-adapter-do-sqlite has no ordinary file to hand over.
• A copy through the API loses authorship and history. The owner can recreate Records with their IDs and backdated createdAt/updatedAt (data-model.md § Backdating on import), but createdBy is overridden with the copier, so a group stack's contributions all end up attributed to the owner. Nothing writes version snapshots or journal entries from outside a write.

Direction

• One portable format carrying Records (including soft-deleted and unlisted ones), createdBy, versions, journal entries, Types and attachments. adapter-json is the natural home.
• The format is specified in the spec, so an export stays readable without the tool that wrote it.
• Import is a full-trust operation, like any direct adapter access: it writes authorship and history as recorded, which no scoped write may.
• Identity moves with the stack; the address doesn't. The new host serves the same owner DID, and APIAdapter's ownerEntityId check lets clients confirm it. References to the old stackUrl are updated by hand.

Questions

• Does the adapter interface gain a write path for history (versions and journal entries), or does import bypass it?
• What does an import do with tokens, and with _install records whose app keys may not reach the new host?
• Is an export one file, or a directory with the blobs beside it?

Actions

• Spec: the export format, and import's trust level.
• Implementation, and a round-trip conformance test: export from one adapter, import into another, and assert every Record, version, journal entry, Type and blob is unchanged.
• Once landed, add "leaving never needs permission" to the design rules (see Add trust, defaults, reversibility and formats to the existing design rules #421), and describe moving hosts in the trust model (see Spec: a trust model page #418).
• Changesets for the packages changed.

Unblocks

#427 (an owner-only export endpoint).