What

Extends the stable identity family from datasets and canvases to the remaining
mutable resources: plot series, processing steps, and the background jobs that
write results back into the document.

Collection positions are now one-shot lookup results only. They no longer cross
an action, job, or persistence boundary.

Why

A usize index is only valid for the document revision that produced it. Any
insertion or deletion in between silently re-points it at a different resource.
That is invisible at the type level, so it surfaces as an edit landing on the
wrong target rather than as an error.

Changes

• SeriesId — SeriesBinding carries an id minted from a per-plot
  allocator. Reordering a plot's series changes their order, not their identity.
• StepId — now owner-local, minted from a dataset-owned allocator that
  sits outside the processing undo snapshot, so undo never rewinds it into
  reissuing a live id. ProcessingStep::new takes the identity as its first
  parameter: every construction site must state where its id came from, and
  appending a placeholder-id step to a live pipeline is a compile error instead
  of a silently duplicated step.
• Jobs — dataset action payloads and the Ilt, Dosy and Process2D
  job/completion pairs carry DatasetId. Completions resolve their target by id
  and discard the result when the dataset is gone, so a long-running job can no
  longer install onto whichever dataset happens to occupy the old position.
• Load-time repair — an exhausted id space is rejected as an invalid project
  instead of defaulting to zero and aliasing an existing id on the next
  allocation.
• Persistence — projects store allocators and identities; scheme recipes
  omit step ids, which an adopting dataset remints on apply.
• Identities are read through checked lookups, so a stale index is inert rather
  than fatal.

Testing

cargo pr-check passes: formatting, source sizes, dependency policy, a
default-configuration build of both frontends, Clippy with warnings denied, and
the test suite in both backend configurations.

Regression coverage was added for each behaviour above and verified by reverting
the fix and confirming the test fails:

• an appended reference-alignment step gets an identity distinct from every
  existing step
• an expanded step editor on one dataset does not match a same-valued id on
  another dataset
• a stale dataset index is inert rather than fatal
• a project whose series id space is exhausted is rejected on load
• a hand-written scheme without step ids loads and applies
• a saved scheme omits step identities
• allocators do not roll back with undo, and step ids survive a project
  round-trip
• a completed job installs onto its original dataset after an unrelated, earlier
  dataset is deleted