feat(rust): SmartCrusher PR4 — lossless-first default + CCR-Dropped restoration

[chopratejas]

Summary

Two things ship here:

1. Restores CCR-Dropped on the lossy path. Python's SmartCrusher always cached the full original payload via CCR when rows were dropped — the cornerstone reversibility guarantee. The Rust port had silently dropped that. PR4 brings it back: `ccr_hash` is populated whenever rows are dropped, and `dropped_summary` carries a `<<ccr:HASH N_rows_offloaded>>` marker so the LLM knows there's retrievable data.

2. Flips the OSS default to lossless-first with a configurable threshold. `SmartCrusher::new()` now tries lossless compaction; if savings ≥ `lossless_min_savings_ratio` (default `0.30`), it ships the compacted form. Otherwise it falls through to the lossy path — which now properly emits CCR markers.

Lossy ≠ data loss

This is the key reframing. In headroom, "lossy" means "compressed view inline; full payload retrievable via CCR cache." Same semantics as Python's CCR-Dropped:

• The runtime (PyO3 bridge / proxy server) caches the full original keyed by `ccr_hash`
• The prompt sees the compressed inline output + a CCR marker
• When the LLM needs more, it tool-calls the retrieval API
• Nothing is ever actually lost

This PR makes that contract explicit again.

The dispatch logic

```rust
crush_array(items):
ccr_hash = sha256(items)[:12] // for lossy path

if compaction enabled:
rendered = compact(items)
if rendered.is_compacted:
savings = 1 - len(rendered) / len(input)
if savings >= threshold: // default 0.30
return lossless(rendered) // nothing dropped, no CCR

// fall through to lossy
kept = lossy_planner(items)
return lossy(kept, ccr_hash, dropped_marker) // CCR-Dropped restored
```

Configurable threshold (no hardcoding)

`SmartCrusherConfig.lossless_min_savings_ratio: f64` defaults to `0.30`. Override at construction time. Set to `0.0` to always prefer lossless when available; set to `1.0` to effectively disable the lossless path.

This is the OSS-grade expression of the boundary. Enterprise customers needing dynamic decisions (sensitivity tags, flow position, model capability) get a fuller `CompactionPolicy` trait when they ask — but for OSS, one knob is enough.

What changed

• `SmartCrusherConfig`: new `lossless_min_savings_ratio` field (default `0.30`).
• `SmartCrusher::new()`: includes the compaction stage by default.
• `SmartCrusher::without_compaction()`: explicit opt-out for legacy parity fixtures and callers who don't want lossless attempts.
• `crush_array`: rewritten with lossless-first dispatch + CCR-Dropped on lossy.
• `process_value`: substitutes the compacted string into the JSON tree when lossless wins (so `crush()` output reflects the win at the public API layer).
• PyO3 bridge: `SmartCrusher.without_compaction()` static method; `Python SmartCrusher` wrapper accepts `with_compaction=True` (default).
• Parity harness: legacy fixtures use `without_compaction()` to preserve byte-equal coverage of the lossy path.

Tests

Suite	Result
Rust `headroom-core` lib (smart_crusher)	281/281 (was 277 — +4 net new)
Python parity (legacy 17 fixtures)	21/21
Python lossless default smoke	3/3 (new)
Python retention	21/21 (updated to opt-in to lossy path)
`make ci-precheck`	✅ green

Six new Rust tests cover the dispatch:

• `lossless_wins_when_savings_above_threshold`
• `lossy_falls_through_when_savings_below_threshold`
• `ccr_hash_is_deterministic`
• `ccr_hash_changes_with_input`
• `lossy_without_compaction_still_emits_ccr_hash`
• `passthrough_paths_do_not_emit_ccr_hash`

What this PR is NOT

• Not a budget enforcer. PR3b will add the document-level token budget + selective lossy escalation when even lossless+lossy can't fit. Out of scope here.
• Not a `CompactionPolicy` trait. Enterprise dynamic decision (signals → strategy) lands when an Enterprise customer asks. Today's threshold knob is the OSS expression.
• Not a re-introduction of PR3a's `DocumentCompactor` walker. That content was lost in the PR2 squash-merge and needs its own follow-up PR.

Next up

• PR3a-redux: re-land the `DocumentCompactor` walker (was on the lost PR3a branch). Walks any JSON document and applies lossless compaction at every compactable spot.
• PR3b: document-level token budget — escalate biggest blocks to lossy + CCR when total still exceeds budget.
• PR5: A/B eval harness comparing format quality on real fixtures.