feat(system): bind cubefs+cubecode+cubecrypt into one running system (cubesys)

Integrates Packages 3-5 over a single shared CubeStore, the literal
CUBELinux premise (data addressed by coordinate, not path). Adds the
cubesys crate (lib + cube CLI + cube-demo) proving two end-to-end
properties: a cubefs path IS a runnable code cell at the same coordinate,
and a sealed record reopens and runs on the same store.

Two latent cross-crate bugs surfaced and fixed while integrating:
- cubecoords: refresh_flags() now preserves out-of-band flag bits
  (8..=15), so cubecrypt's HEADER_FLAG_ENCRYPTED survives refresh.
- cubestore: record codec now serializes raw flag bits (TLV tag 12) so
  the encrypted bit survives the store round-trip.

All gates green (./check, incl. cubefs --features mount).

cubecrypt/src/lib.rs

@@ -38,22 +38,22 @@ pub use env::{CubeEnv, EnvError, Selector, HEADER_FLAG_ENCRYPTED};
 pub use transform::{CryptoError, Key, KeySlot, TransformId};
 
 use cubecoords::{CubeHeader, Czyx};
-use cubestore::{CubeStore, HashBackend};
+use cubestore::{CubeBackend, CubeStore};
 
 /// An append-only access log living in a Null-cube range. Each [`AccessLog`]
 /// targets one Null-cube head coordinate and appends fixed-size entries
 /// (record coord + op byte + 8-byte timestamp). It is "tamper-evident" in the
 /// weak sense that the log itself can be stored encrypted via another
 /// [`CubeEnv`]; this type only provides the structure and append/read.
-pub struct AccessLog {
-    store: CubeStore<HashBackend>,
+pub struct AccessLog<B: CubeBackend> {
+    store: CubeStore<B>,
     head: Czyx,
     next: u8,
 }
 
-impl AccessLog {
+impl<B: CubeBackend> AccessLog<B> {
     /// Bind a log to a Null-cube head coordinate (entries append along X).
-    pub fn new(store: CubeStore<HashBackend>, head: Czyx) -> Self {
+    pub fn new(store: CubeStore<B>, head: Czyx) -> Self {
         AccessLog {
             store,
             head,