feat(system): bind cubefs+cubecode+cubecrypt into one running system (cubesys)

Integrates Packages 3-5 over a single shared CubeStore, the literal
CUBELinux premise (data addressed by coordinate, not path). Adds the
cubesys crate (lib + cube CLI + cube-demo) proving two end-to-end
properties: a cubefs path IS a runnable code cell at the same coordinate,
and a sealed record reopens and runs on the same store.

Two latent cross-crate bugs surfaced and fixed while integrating:
- cubecoords: refresh_flags() now preserves out-of-band flag bits
  (8..=15), so cubecrypt's HEADER_FLAG_ENCRYPTED survives refresh.
- cubestore: record codec now serializes raw flag bits (TLV tag 12) so
  the encrypted bit survives the store round-trip.

All gates green (./check, incl. cubefs --features mount).

cubestore/src/lib.rs

@@ -64,6 +64,7 @@ pub trait CubeBackend {
 /// Decision: packs to `u32` (not a 4-tuple key) so the map layout matches the
 /// PDF's `HashMap<u32, Vec<u8>>` example exactly and stays cheap. A production
 /// backend would replace this with the on-disk store.
+#[derive(Clone)]
 pub struct HashBackend(pub HashMap<u32, Vec<u8>>);
 
 impl HashBackend {
@@ -106,6 +107,7 @@ impl CubeBackend for HashBackend {
 /// The header is length-prefixed so the body boundary is recoverable without
 /// a fixed schema — this is the "evolve toward explicit C/Z/Y/X-mapped flag
 /// bytes" step the PDF mentions, done inline.
+#[derive(Clone)]
 pub struct CubeStore<B: CubeBackend> {
     backend: B,
 }
@@ -180,6 +182,13 @@ mod record_codec {
         if let Some(a) = h.last_remote_access {
             put_u64(&mut out, 11, a);
         }
+        // Tag 12: raw flag bits. Serializes out-of-band/spare bits (e.g.
+        // `cubecrypt::HEADER_FLAG_ENCRYPTED`) that are not derived from
+        // structured fields, so they survive an encode/decode round-trip.
+        if h.flags.bits() != 0 {
+            out.push(12);
+            out.extend_from_slice(&h.flags.bits().to_le_bytes());
+        }
         out
     }
 
@@ -257,6 +266,14 @@ mod record_codec {
                     h.last_remote_access = Some(v);
                     b = rest;
                 }
+                12 => {
+                    if b.len() < 2 {
+                        return None;
+                    }
+                    let raw = u16::from_le_bytes([b[0], b[1]]);
+                    h.flags = cubecoords::HeaderFlags::flags_from_bits(raw);
+                    b = &b[2..];
+                }
                 _ => return None, // unknown tag -> reject (strict at Package 1)
             }
         }