Create a point of a volume

Admits a root capture of one named volume. Eligibility, readiness, dependent stacks, the access check, a generation probe, the operation record, and the locks all happen before the answer, so a held or stale lock is a real 409 rather than a background failure. A refused request is not recorded, so the same idempotency key can be sent again once the lock is gone. One repository lock covers the node: only one capture, verification, restore, or repository replacement runs at a time on it. A node with no repository answers 503 capability_unavailable with reason repository_not_initialized. The capture runs in the background and is followed by a repository-wide metadata check before the operation ends. Only a Full Admin API token may call it; any other scope is refused with 403 SCOPE_DENIED.