commit

Hashes the exact stable files and atomically writes their commit marker last. A crash before the move leaves either the revocation guard or no marker, both of which fail closed on the next process start.