feat(core): introduce stable typed resource identities

[nmrtist]

Summary

Replace positional collection indices with typed IDs as the stable identity
for datasets, canvases, and objects. Collection indices are now one-shot
lookup positions only and never cross action, job, frame, or persistence
boundaries.

What changed

• Typed ID newtypes — DatasetId, CanvasId (UUID-backed, global) and the
  owner-local ObjectId — with an allocator whose high-water counter is
  persisted but excluded from undo rollback.
• Dataset, canvas, and object consumers migrated to typed references:
  bindings, lineage, projections, automation resource lineage, table
  transforms, tiling, and the sidebar/inspector.
• Project persistence stores and restores typed references and object IDs;
  loading validates the id space and rejects an exhausted allocator with a
  recoverable error instead of aborting.
• Newtypes hardened: From<u64> removed and the inner field un-pubed, so a
  raw index can no longer be silently promoted to an identity.
• References resolve by ID with explicit errors instead of index sentinels;
  page/dataset ordering is deterministic (first appearance), independent of
  UUID value.
• AGENTS.md: added the stable-identity boundary rule.

Testing

• Regression tests: ordering determinism, stale-index tolerance (no panic),
  object-id exhaustion on load (returns ProjectError::Invalid), and missing
  table-source reporting.
• cargo pr-check passes (fmt, source size, cargo-deny, clippy -D warnings,
  tests on both the reference and DataFusion backends).