synckit: enforce paid-only first-party sync + authoritative blob size + atomic caps (ultra-fuzz Run 3 #1/#2/#3)