feat: bind Host interfaces to scope Object lifetimes

Register explicit scope/name coordinates independently of Definition type. Require provider-attested current scope snapshots for fetch and dispatch, compare optional scope_ref at membership precedence, and retain the same Descriptor through result validation.

Migrate FS pinned-root boundaries and public self-scope example; document provider atomicity/lifecycle and root-only FS support. Add lifecycle, ref, replacement-race, root-lineage and compile-time exposure regressions.

Validation: cargo fmt --all --check; git diff --check; cargo check --workspace --all-targets; cargo test --workspace --all-targets and --doc (232 passing test-harness cases including doctests); nix develop --command cargo clippy --workspace --all-targets -- -D warnings; RUSTDOCFLAGS=-Dwarnings cargo doc --workspace --no-deps. Narrow wip-host suite also passed.

README.md

@@ -226,25 +226,44 @@ choose the ordered interface set for each object publication:
 
 ```rust,ignore
 let mut interfaces = wip_host::InterfaceRegistry::new();
-let messenger = interfaces.register(MessengerDefinition, None)?;
+let scope = wip_host::Scope::new("/service")?;
+let messenger = interfaces.register(&scope, "messenger", MessengerDefinition, None)?;
+
+// Inside the provider coherent backend boundary, not a stale scope prelookup:
+let current = wip_host::ScopeObservation::new(&scope, &current_scope_object);
 
 let published = wip_host::PublishedObject::new(request_scoped_object)
-    .expose(&messenger)?;
-let protocol_object = published.protocol_object();
+    .expose(&messenger)?
+    .bind_scope(current);
+let protocol_object = published.protocol_object_at("/service/item")?;
 ```
 
 `expose` compiles only when the object implements the generated definition's
 interface trait. Implementing a trait does not expose it automatically, empty
 interface sets are valid, insertion order is preserved, and duplicate
-references are rejected. Registry references are opaque and remain outside the
-descriptor; generated descriptors contain neither those references nor Rust
-trait identity.
+references are rejected. Registry collisions use exact `(scope, name)` pairs,
+not Rust Definition identity; the same Definition may be registered at multiple
+coordinates. Structured references remain outside the Descriptor.
+
+`Scope` carries a private Object publication lifetime. Keep it for ordinary state
+updates; retire it with `remove_scope` and create a fresh Scope on deletion,
+replacement or movement, even at the same path. Providers attach a current
+`ScopeObservation` from the scope Object inside the coherent target/backend
+boundary, never from a separate prelookup. The scope Object need not expose any
+interfaces. Fetch uses `ObjectProvider::fetch_interface(&provider, &registry,
+&reference)` to observe the visible scope Object and return its optional ref,
+Descriptor and Interface validator together; retained artifacts alone are not
+publication. Calls require the current attached lifetime and check supplied
+`scope_ref` at membership precedence; omission adds no identity precondition.
+Refs, Object validators and Interface validators retain distinct responsibilities.
+See [MIGRATION.md](MIGRATION.md) for the provider atomicity and lifecycle contract.
 
 Dispatch is qualified by interface reference and operation name and targets a
 canonical Worldspace path. An `ObjectProvider` validates that path before
 resolution, maps malformed paths to `InvalidRequest`, then resolves a valid path
 exactly once inside `with_object`; the host checks the supplied object validator,
-current interface membership, interface validator, descriptor operation,
+current scope lifetime/optional scope_ref and interface membership, Interface
+validator, Descriptor operation,
 operation-specific object-validator policy, arguments, and authorization in
 canonical precedence. Path and children remain provider resolution context and
 are never projected by `WipObject`; host-private fields and backend handles are