[NIDX-02C] Cut the Property database over to the native writer

Parent: #14007 Blocked by: #14074 (NIDX-02B), or by #14073 directly if 02B is folded in here.

This is the leaf that puts native bytes under a live Property writer. It is deliberately last and deliberately small: by the time it starts, the encoder is proven against two independent readers (#14073) and the plugin contract is proven against the lifecycle manager (#14074), so the diff here is registration plus selection plus rollback.

Boundary

1. Register the native plugin in inverted.NewStore's configuration.
2. Resolve one Property-database-wide implementation selection at startup, before scanning the directory or opening any shard store, and have banyand/property/db/shard.go:newShard use that selection for every existing and newly created shard. Today that line unconditionally calls inverted.NewStore.
3. Establish exclusive writer ownership before either implementation opens a shard writer; a process that cannot establish ownership fails rather than proceeding.
4. Implement rollback: stop admission, drain durable callbacks, close every active shard writer, change the selection, reopen the same files with the retained legacy constructor.

Constraints carried from the workstream

• Selection is Property-database-wide, never inferred per shard, and never inferred from ICE segments, snapshot manifests, CRC32 values, or other writer-origin heuristics.
• No index-local PID file, lock file, or writer-origin marker. Such runtime files are outside ICE/snapshot compatibility.
• Simultaneous native and legacy writers for the Property database are prohibited.
• Legacy-created shards open without rewrite and retain documents, repeated stored values, deletions, and explicit order.
• The retained legacy constructor is an explicit rollback choice during the compatibility window, not a second active writer.

The dependency-policy gate — resolve before implementation

Registration is the one line in the whole NIDX-02 ladder that cannot avoid naming the retired dependency: the plugin is registered through the aliased index package, and that selector carries the token the lexical gate forbids in added lines. Every other leaf is reachable without it.

This must be settled before the first commit, as an explicit decision recorded in the PR description: either a narrow, pre-approved exemption for the registration call site, or a neutral bridge that exposes registration without the token. Do not begin implementation with this open, and do not widen the exemption beyond the single call site.

RED / E2E / suites

To be sharpened when this becomes the oldest unblocked leaf. The RED anchors on newShard selecting the native implementation for a legacy-created shard; the e2e on update → durable callback → close/reopen → exact query and ordered result, plus a rollback cycle reopening the same files with the legacy constructor.

Non-scope

Merge, expiry, GC, backup, repair integration, range and boolean query, and explicit sort beyond what Property's current callers already exercise. Those follow once the writer is live.