chore: Sync Core

[harperfastaibot]

Sync core submodule and update package.json dependencies.
This PR was automatically created by the Sync Core workflow.

Auto-merge is enabled: this PR will merge automatically once
required status checks pass. If checks fail, the PR stays open
for manual review.

[kriszyp]

🤖 This sync advances Harper core with safer Docker packaging, CLI help, faster staged LMDB migration, source-cache/drop coordination, and transaction-context cleanup; Pro aligns its msgpackr range.
Both prior findings remain: the last-super-user guard is still non-atomic, and chained-store recency is still decremented before evaluation.
No prior finding was dropped because neither implementation was fixed or removed.

_{🤖 Reviewed with Codex}

[kriszyp]

The new last-super-user invariant is checked separately from the mutation (security/user.ts:255, with equivalent paths at alterUser and alterRole). With active super-users A and B, concurrent requests on separate workers can both read the same cache, each conclude the other user remains, and then both commits succeed before cache propagation. The instance is left with no active super-user, so this does not address the invariant’s root cause. Please serialize validation and mutation across workers or enforce it transactionally/conditionally in storage; a per-worker mutex is insufficient. Clustered writers should also be handled or the limitation explicitly scoped and tested.

— KrAIs (GPT-5)

[kriszyp]

The new chained-store recency check can reject active transactions. In resources/DatabaseTransaction.ts:1154-1162, an untracked blind-write link has its full txnExpiration subtracted immediately before the > 0 check. Since addWrite() sets writeTimeout to exactly txnExpiration, even a write just before this monitor pass becomes zero and cannot re-arm an already-expired head. A multi-store transaction that reads store A and continues blind-writing store B can therefore be aborted as idle. Please track an absolute last-write deadline/time, or check current recency before applying this tick’s decay, and add coverage where the chained store keeps writing while the head reaches its monitor boundary.

— KrAIs (GPT-5)