[Story]: copilot-push runs a week unattended without losing data or filling the disk

## Story Statement

As an operator, `copilot-push` runs unattended for a week without losing a record, duplicating
one, or filling the disk.

## Real Intent

#228 made the drain lossless and monotonic under every failure an adversarial gate could
produce. It did **not** bound the file. The spool grows for ever, and the only rotation that
happens is one we do not control.

## Background and Context

VS Code holds the spool open for append; truncating under a live writer leaves the kernel
zero-filling the gap, which is why the drain uses offset-only checkpointing. That reasoning is
sound — but it leaves rotation unsolved.

Measured growth: **73 KB → 315 KB in six minutes** of ordinary use with `captureContent: false`.
The gate reproduced the loss case before #228 closed the identity half: replacing the spool and
letting it grow past the old offset resumed mid-file and lost 7 records, uncounted.

## Source of truth (links)

#230 · PR #228 (identity fix, `copilot/spool/identity.rs`) · `docs/governance-auth/commands.md`

## Acceptance Criteria

- Spool size is bounded over a long-running session; state the mechanism and who performs it.
- Conservation holds across a rotation: **no byte advances past a record that was neither
delivered nor counted in `discarded_total`**.
- A rotation occurring **mid-drain** loses nothing.
- **Falsification:** disable the rotation handling, watch the conservation assertion fail,
restore.

## Out of Scope

Whether this spool is worth draining at all. RFC-0003 §2a correction 3 records that it carries
usage and orchestration but **no** accept/reject signal. That decision is the owner's.

## Dependencies and Blockers

Builds on #228's file-identity work; do not re-litigate the no-truncation decision without
re-reading why.

## Assumptions

VS Code recreates rather than truncates the spool on restart — worth confirming, since it
changes which rotation path is the common one.

## Implementation Notes

Options: drain-side rotation with the append-holder problem handled, external `copytruncate`,
or rotating at VS Code restart boundaries.

## Test Expectations

Extend the existing rotation integration test to cover mid-drain rotation and a bounded-size
assertion.

## Verification evidence

To be filled at close.

## Human accountable owner

@stephane-segning

## AI Usage Declaration

AI-assisted. Growth figures and the loss reproduction are measured, not estimated.

## Human verification completed

- [ ] Reviewed

Begin with the drain and identity context in copilot/spool/identity.rs and reread #228's no-truncation rationale. Run the existing rotation integration test, then extend it for a mid-drain rotation and bounded-size assertion. Done means the mechanism and responsible actor are stated, conservation holds across rotation, and the falsification check fails when rotation handling is disabled.

Scritto dal modello di indicizzazione a partire dal testo della issue.