feat(system): bind cubefs+cubecode+cubecrypt into one running system (cubesys)

Integrates Packages 3-5 over a single shared CubeStore, the literal
CUBELinux premise (data addressed by coordinate, not path). Adds the
cubesys crate (lib + cube CLI + cube-demo) proving two end-to-end
properties: a cubefs path IS a runnable code cell at the same coordinate,
and a sealed record reopens and runs on the same store.

Two latent cross-crate bugs surfaced and fixed while integrating:
- cubecoords: refresh_flags() now preserves out-of-band flag bits
  (8..=15), so cubecrypt's HEADER_FLAG_ENCRYPTED survives refresh.
- cubestore: record codec now serializes raw flag bits (TLV tag 12) so
  the encrypted bit survives the store round-trip.

All gates green (./check, incl. cubefs --features mount).

cubesys/Cargo.toml

@@ -0,0 +1,21 @@
+[package]
+name = "cubesys"
+version = "0.1.0"
+edition.workspace = true
+license.workspace = true
+description = "CUBELinux-2 system integration: one CubeStore shared by cubefs, cubecode and cubecrypt (PDF Packages 3-5 bound into a single running system)."
+
+[dependencies]
+cubecoords = { path = "../cubecoords" }
+cubestore = { path = "../cubestore" }
+cubefs = { path = "../cubefs" }
+cubecode = { path = "../cubecode" }
+cubecrypt = { path = "../cubecrypt" }
+
+[[bin]]
+name = "cube"
+path = "src/bin/cube.rs"
+
+[[bin]]
+name = "cube-demo"
+path = "src/bin/cube_demo.rs"