Add source-paired HAMT root ownership

[helly25]

Add a small RAII owner that always keeps a HAMT snapshot root paired with the block source that allocated it. This makes snapshot ownership explicit and prevents release through the wrong allocator domain.

AG;DR

This change adds HamtRootOwner, a move-only internal owner for an immutable HAMT root and its originating BlockSource.

The owner:

• releases the root through its paired source;
• supports empty, adopted, moved, reset, and released states;
• keeps move assignment and reset safe when the incoming and existing roots use different sources;
• exposes the borrowed root and source without transferring ownership;
• documents the ownership contract in HAMT_STORAGE.md.

Validation on synchronized head 6c17d353e:

• bazel test //mbo/container:hamt_root_owner_test
• bazel test --noshow_progress //... (166 pass, one intentional exception-policy skip)
• bazel test --config=clang --config=asan --config=asan-macos //mbo/container:hamt_root_owner_test
• focused pre-commit hooks for all changed files, with local clang-tidy and trunk-format execution omitted as requested; formatting and structural lint hooks pass
• git diff --check

The first remote clang-tidy run identified const-correctness, static-helper, and intentional moved-from-state diagnostics in the new test. The follow-up commit applies the mechanical const/static fixes and documents narrowly suppressed moved-from checks where the specified post-move contract itself is under test.

Focused LLVM coverage compilation was attempted locally, but the pinned LLVM linker cannot parse the host Command Line Tools SDK's newer arm64e.x1 TAPI architecture. The pull request's Ubuntu Clang coverage job is therefore the authoritative coverage validation. No production coverage exclusions, scope changes, or baseline changes are included.