CommitLogGraph: Pick<Graph, "commitMetadataDerived" | "commitLog">

Capability slice handed to commitLog.

The function registers a Graph.commitMetadataDerived that reads Graph.commitLog — those two methods are the entire surface. commit, input, derived, hydrate, snapshot, exportModel, the per-node subscribe, and the time-travel readers are intentionally unreachable: a bounded buffer that can mutate the engine ceases to be a buffer and becomes a parallel writer, breaking §11's "the engine is its own observer" commitment.

Narrowing is type-level. A real Graph is still assignable, so call sites keep working; the discipline is enforced at compile time inside the implementation.