Add persistent HAMT child replacement

[helly25]

Add persistent HAMT child replacement without modifying older snapshots.

AG;DR

Head 37cf569 additionally tests rejection of child replacement in terminal collision nodes, proving unchanged entries, no allocation, and no additional child reference. This closes the remaining reachable rejection-condition test gap. Focused hooks pass with local clang-tidy/trunk-fmt skipped. No exclusions or baselines change; replacement-head full-suite and remote checks validate the final tree.

Head c81f420 uses checked value_or(nullptr)/NotNull allocation bindings throughout child replacement tests and a const construction pointer with the original optional return in TryReplaceChild. This preserves mutable ownership of the returned node without casts or warning suppressions. Focused pre-commit passes, with local clang-tidy and trunk-fmt skipped; full-suite and remote replacement-head validation are running. No coverage exclusions or baselines change.

Synchronized to fully green PR 460 head f815a47 and immediately pushed synchronization 9341145. The inherited lookup, packed-storage, checked allocation, and rejection-path coverage repairs are preserved. Current-head validation is pending; the next repair updates replacement tests to checked pointer bindings and the construction helper to its parent's const-pointer/original-result pattern. Local clang-tidy and trunk-fmt remain disabled. No merging is requested.

TryReplaceChild copies a normal packed node and replaces one dense child position, preserving bitmap and entries. The new node retains its resulting children, including a replacement that aliases an existing child. Allocation failures, null replacement, invalid positions, and collision-node input leave the original and reference counts unchanged. Source metadata is returned exactly as acquired; non-throwing entry copies/destruction are required.

Tests cover replacement, self-replacement, invalid inputs, bounded exhaustion, and child lifetime/reference balancing. HAMT_STORAGE.md documents ownership and failure semantics. This draft follows PR 460 and requests no merging. Local validation is in progress; local clang-tidy and trunk-fmt are skipped as requested. Remote CI remains pending.