Brings in fff6d3e..origin/main (4 commits since previous merge):
  - #897 blockassembly columnar->row fallback on Unimplemented
  - #896 asset on-demand subtree-data admission control + 503/Retry-After
  - #766 utxo: verify spend ownership in Unspend
  - #700 health: disk space check

Conflict resolutions:
  - services/blockassembly/Client.go, util/http.go, util/http_test.go:
    take theirs. Main has the post-Copilot-fix versions of these files
    from #896 and #897 (parseRetryAfter strict-Atoi, debug log on
    columnar fallback, extended TestParseRetryAfter cases) — they
    supersede the pre-fix versions still living on pr-828.
  - stores/utxo/aerospike/un_spend.go: take ours (native-op call,
    no SpendingData arg). The ownership check #766 added to the UDF
    path requires a coordinated update to the BSV-forked aerospike-
    server's subOpUnspend dispatcher. Until that lands, the
    native-op path on this branch skips ownership verification.
    Tracking issue filed.

Two related items from the external security review:

1. The aerospike_use_native_teranode_ops longdesc previously said "Safe
   to enable on mixed clusters: capability probe falls back to UDF when
   the fork is absent". That's misleading — the probe writes a single
   key whose digest pins it to one partition, so a mixed-version
   cluster can produce false-positive (probe lands on a BSV-fork
   master, runtime writes to partitions still on stock Aerospike fail
   with PARAMETER_ERROR) or false-negative (cached for Store lifetime
   even after the cluster finishes upgrading). Rewrite the rolling-
   deploy section to be explicit, drop the "Safe to enable" claim, and
   tell operators to keep the setting false until the rolling upgrade
   completes.

2. Probe key was a fixed string ("_teranode-native-op-probe") shared
   across every teranode pointing at the same cluster. Two instances
   booting concurrently could interleave PutBins / Operate / Get
   sequences and observe each other's writes, producing a false-
   negative for one of them. Add PID + time.Now().UnixNano() to the
   key so every process gets its own; the 60s TTL still bounds the
   record's residency if Delete fails.

Follow-ups still tracked in the PR body: per-call PARAMETER_ERROR ->
UDF fallback in teranodeBatchRecord (separate PR), and the un_spend.go
SpendingData ownership check landed for the UDF path in #766 but is
not yet wired into subOpUnspend on the native-op side — issue #899.

…ranch

The merge from main (#766: verify spend ownership in Unspend) needed two
catch-up changes on this branch's native-op-migrated unspendLua:

1. executeTeranodeOp now receives spend.SpendingData.Bytes() as a third
   arg + a nil-guard. The UDF fallback path (useNativeTeranodeOps=false,
   default) forwards the arg verbatim into client.Execute, so the
   ownership check the Lua "unspend" added in #766 works end-to-end.
   The native operate-path forwards the arg over the wire too, but the
   BSV-forked server's subOpUnspend dispatcher must be updated before
   the check is actually applied server-side — tracked in #899.

2. unspendLua's response-handling branch for LuaStatusError now
   distinguishes res.ErrorCode == LuaErrorCodeTxNotFound and returns
   errors.NewNotFoundError. Without this branch, #766's
   TestUnspendOwnership_NotFound saw the Lua-side "TX not found"
   response wrapped as StorageError. The merge conflict landed at the
   call site only; this response-handling change from main slipped past.

The native subOpUnspend=3 dispatcher in the BSV fork of aerospike-server now
enforces the #766 SpendingData ownership check. Update the stale un_spend.go
comment that said the dispatcher still needed the fix, document the minimum
server-build requirement in the UseNativeTeranodeOps longdesc, and drop the
private-repo reference from the native_op.go header comment.