upgrade gitsheets 1.4.1 → 2.x (Rust core), pairing with upstream per-sheet refresh (gitsheets#184)

The API is pinned to \`gitsheets ^1.4.1\` — a full major version behind the 2.x line, which replaced the JS engine with a Rust core (canonical TOML, schema validation, and tree ops all native; measured ~4–5× faster on large-sheet commit workloads, with byte-identical output). A migration guide ships with 2.x.

Beyond the version bump, the upgrade is the right moment to retire three workarounds that all trace to the stale-\`Sheet\`-cache gap tracked upstream as JarvusInnovations/gitsheets#184:

- \`apps/api/src/store/store.ts\` — \`swapPublic()\` and the funnel-all-reads-through-memory rule exist because direct \`sheet.query*()\` after a transact reads the pre-commit tree (documented in \`specs/behaviors/storage.md\` under "Direct gitsheets reads after a transact").
- \`apps/api/src/routes/attachments.ts\` — deliberately bypasses \`Sheet.getAttachment()\` and streams via raw \`git cat-file\` to dodge the same cache.
- \`apps/api/src/lib/data-repo-lock.ts\` — a parallel mutex because gitsheets' internal one isn't exposed for non-transact git ops.

Ideally the upgrade lands alongside (or drives) the upstream #184 implementation so those can be deleted rather than ported.

Also worth checking during the upgrade: the \`asValidator()\` cast in \`apps/api/src/store/public.ts\` (Zod v4 vs \`StandardSchemaResult\` structural mismatch) and the \`BlobObject.write(hologit, buf as unknown as string)\` casts (\`importer.ts\`, \`people.ts\`) — the 2.x API surface (\`BlobHandle\`, typed error classes) may eliminate both.