feat(system): bind cubefs+cubecode+cubecrypt into one running system (cubesys)

Integrates Packages 3-5 over a single shared CubeStore, the literal
CUBELinux premise (data addressed by coordinate, not path). Adds the
cubesys crate (lib + cube CLI + cube-demo) proving two end-to-end
properties: a cubefs path IS a runnable code cell at the same coordinate,
and a sealed record reopens and runs on the same store.

Two latent cross-crate bugs surfaced and fixed while integrating:
- cubecoords: refresh_flags() now preserves out-of-band flag bits
  (8..=15), so cubecrypt's HEADER_FLAG_ENCRYPTED survives refresh.
- cubestore: record codec now serializes raw flag bits (TLV tag 12) so
  the encrypted bit survives the store round-trip.

All gates green (./check, incl. cubefs --features mount).

cubecoords/src/lib.rs

@@ -194,6 +194,13 @@ impl HeaderFlags {
         HeaderFlags(bits)
     }
 
+    /// Alias for [`from_bits`] used by record decoders that reconstruct a
+    /// header's raw flag field.
+    #[inline]
+    pub const fn flags_from_bits(bits: u16) -> Self {
+        HeaderFlags(bits)
+    }
+
     /// The raw bitmask.
     #[inline]
     pub const fn bits(&self) -> u16 {
@@ -256,6 +263,12 @@ impl CubeHeader {
 
     /// Recompute the flag bits from which fields are present. Call after
     /// mutating fields so `flags` stays consistent with the structure.
+    ///
+    /// Known field flags occupy bits 0–7 (title..associations). Any
+    /// out-of-band/spare bits set directly on `flags` (e.g.
+    /// `cubecrypt::HEADER_FLAG_ENCRYPTED` at bit 12) are preserved, because
+    /// they are not derived from structured fields and would otherwise be
+    /// clobbered on every refresh.
     pub fn refresh_flags(&mut self) {
         let mut f = 0u16;
         if self.title.is_some() {
@@ -279,6 +292,10 @@ impl CubeHeader {
         if !self.linked_records.is_empty() {
             f |= HeaderFlags::HAS_ASSOCIATIONS;
         }
+        // Preserve spare/out-of-band flag bits (bits 8..=15) that are not
+        // derived from structured fields.
+        const DERIVED_BITS: u16 = 0x00FF;
+        f |= self.flags.bits() & !DERIVED_BITS;
         self.flags = HeaderFlags::from_bits(f);
     }
 }