[Mola-maker]

Area P batch 1: P2, P14, P1, P7, P8 + retro cost-accounting fix

Part of Area P of the LayerFS 2.0 working plan
(Ephemeral-AI-Lab/layerfs-connect#14). P2 is tracked as #484 here;
P1, P7, P8, P14 are tracked as layerfs-connect#53, #58, #59, #65.
This batch contains only product code (core/, engine/, api/) and
its tests — no plans, build infrastructure, or docs-only changes.

Done-when coverage in this batch (each client can mount, run a command,
commit, and read history; push/pull remain blocked by R7, as before):

• P2 — JS SDK constructor options (LayerFS.open(name, options?),
  LayerFS.init(name, folder, timeout?, options?)): explicit options
  win over LAYERFS_* environment, which wins over built-in defaults;
  the resolved snapshot is deep-copied once at construction.
• P14 — branch paging and snapshot continuation: list_branches
  short pages resume after returned items, and workspaces resolve their
  branch even past the 64-branch history page (the 65th-workspace fix:
  the branch-name map now follows history continuation pages). The
  snapshot's per-branch commit cut is budget-aware.
• P1 — Node SDK history calls: branch.graph(branch, pageSize, pagePos) bounded traversal and branch.changed_paths(commit, pageSize, pagePos) with the three-parent rule.
• P7 — commit author and labels: workspace.commit(ws, message, force, { author?, labels? }) with author / per-label / total-labels
  byte limits; author and labels are stored alongside the commit and
  are NOT identity (derive is unchanged).
• P8 — read a file at any commit or layer: JS + CLI surface for
  commit/layer reads plus the binary flag on fs.read (results carry
  bytes instead of text). Reads never mount a workspace and never
  move a branch head.
• Retro finding 1 — commit reply cost accounting: commit reply
  costs previously omitted LWW decisions and merge units, so a page
  could pass the 49,152-byte estimate and fail the control codec, and
  an oversized unit was silently omitted. Costs are now charged at
  actual encoded size via a shared helper; cursor pagers always make
  progress; oversized units are omitted wholesale with
  unitsTruncated: true (present on every commit object). This also
  fixes a snapshot continuation bug the review caught: a rejected
  commit previously produced a duplicate map key the control decoder
  rejects; it now yields exactly one restart continuation, proven by a
  regression test that fails on the old code with
  ControlError("SDK field repeated").

Verification (Linux, Disposable stores, this branch)

• Rust: area_p14_paging 4/4, area_p1_history 4/4,
  area_p7_attribution 8/8, sdk_method_golden 1/1 (under
  umask 022), boundary guard 964 PASS.
• JS: area-p harness 239 cases + P7/P8 groups, calls 64, cli 104/104.
• Real-addon E2E and Docker/FUSE tests: NOT RUN (no Docker, no
  /dev/fuse in the build environment); disclosed, not claimed.
• Pre-change baselines were recorded for the retro fix (p7 6/2 and
  p14 2/1 before, all green after).

Known follow-ups (not in this batch)

• unitsTruncated public documentation lands with the P9 agent.md
  update (P9 event stream is the next slice).
• P9–P13, P4 (Python), P5 (MCP), P15 (npm publish), and the
  layerfs-connect integration follow as separate PRs.
• Push/pull history work stays blocked by R7 and is not simulated.