Put entry and entity operations in change sets: diff, publish and revert #2515

Part of #2416 (F-CNT). Next slice after soft delete (#2499), now that atomic publish (#2482) and revert (#2511) are on v2: change sets can hold operations on entries and entities. Each operation is resolved against stored entry versions, diffed field by field, published and reverted like a schema operation (CHG-01, CHG-03, CHG-05, CHG-06). This moves Entries.PublishedVersion (#2491) for the first time.

Scope

• Item kinds: an entry operation points at an entry of a plain content type and an entity operation at an entry of an entity type, both in the site and not deleted. The wrong kind for the entry fails with item_kind_mismatch; a missing or deleted entry, or a missing version, fails as for schema items. The event's previous version is the base version's row, as for schema items.
• Core (FluentCMS.Core.ChangeSets): ItemDiff.ForEntry diffs two versions of an entry field by field with ValueDiff.Compare (Add the field-level change set diff #2475). On an entity a field's value is its whole fact, so a new source or validity shows as a change. A create lists every field as added; a delete lists them as removed.
• IChangeSetDirectory.DiffAsync covers entry and entity operations, reading every version they name in one query.
• Publish moves each entry's published version from its operation's base version to the proposed one, inside the same unit of work and with the same stale-base checks as schema items. A delete clears the published version, so the entry is unpublished, not deleted: its draft and history stay, and the entry states slice calls it archived. A soft-deleted entry fails the publish until it is restored. Events: entry.published and entry.unpublished, or entity.published and entity.unpublished.
• Revert of a set with entry operations restores each entry's earlier published version, through the same publish.
• Audit subjects: the entry directory names entries of entity types entity, so an entity's own events and the change set events about it share one history (AUD-01).

Out of scope

• Entry states (CNT-01): the next slice, on top of this one.
• Entry writes that open or join a change set themselves, as SCH-05 does for content types. They follow the pattern SCH-05 lands with. Until then a write stores a draft version and an operation points at it.
• The resolved diff for pages affected by an entity change (CHG-03, ENT-04): F-ENT (F-ENT: Entity registry with sources, validity and blast radius #2417).
• Entry tools (F-MCP F-MCP: MCP server, agent credentials, scopes and caps #2423).

Acceptance

• An entry create and an entity update in one set are stored with their item kinds. The wrong kind, a deleted entry and a missing version each fail and write nothing.
• The diff of an entry update lists each changed field with its before and after values, and leaves out unchanged fields. A create and a delete list every field.
• Publishing the set moves both published versions and appends one event per item with its previous version. Resolved views and where used then see the published version.
• A set based on a version that is no longer published fails with base_version_stale and moves nothing. A soft-deleted entry fails the publish.
• Publishing a delete unpublishes the entry and keeps its versions. Reverting the set puts every entry back at its earlier published version and moves the original set to reverted.
• A failure injected at any audit append of a publish leaves no pointer moved.
• Everything above passes on SQLite and PostgreSQL, and ProjectReferenceRulesTests pass with no new package.