notion-datasource-sync: complete schema and property authority model

Parent epic: #698

Problem

The conservative schema/property subset is implemented, but the broader property model still mixes supported values, computed read-only values, and fail-closed gaps that need principled promotion criteria.

Current Evidence

• Safe schema command path supports add property, rename property, and additive select/multi-select options with base schema guards.
• Destructive/type-changing/status schema operations remain fail-closed by design.
• Common writable property values and relation write subsets have coverage.
• Computed/generated properties are guarded as read-only.

Scope

• Define which additional schema mutations are safe to promote, if any.
• Keep destructive/type-changing/status-group workflows behind impact reports, explicit approval, fake tests, and live proof.
• Add explicit canonicalization/policy coverage for place, unique_id, wiki verification behavior, status caveats, people/user identity and pagination, buttons/forms, and unsupported objects.
• Complete relation/rollup/formula handling: checkpoint health, incomplete rollup states, formula depth/error cases, relation-sharing diagnostics, and empty-vs-inaccessible distinctions.

Repro / Proof Instructions

1. Build fake-service fixtures for each candidate schema/property shape before live tests.
2. For each promoted property write, prove stale-base conflict behavior and post-write hash verification.
3. For each read-only/computed property, prove writes fail closed before remote mutation.
4. For relation/rollup/formula cases, test empty, inaccessible, incomplete, and complete states separately.

Acceptance Criteria

• Support matrix distinguishes supported writes, read-only observation, fail-closed feasible gaps, and public-API impossibilities.
• Each promoted shape has canonical data model, fake-service tests, and live evidence when it mutates remote state.
• Unsupported shapes produce typed diagnostics, not silent omission or empty-value interpretation.

The issue names no files or entry points; start by defining the support matrix and the candidate schema/property shapes to cover. Build fake-service fixtures first, then test stale-base conflicts, post-write hash verification, fail-closed read-only writes, and empty, inaccessible, incomplete, and complete relation/rollup/formula states. Done means typed diagnostics, canonical models, fake-service coverage, and live evidence for remote mutations.