Immutable trigram segment file: write and read.

One segment is a self-contained, immutable index over a set of documents. Layout (little-endian, header sector-aligned):

   [0, 4096)                      header (magic, offsets, doc_count, watermark)
   [4096, +offset_table_len)      offset table: u32 per gram, direct-addressed
   [postings_off, +postings_len)  postings region (byte 0 is a sentinel)
   [sidecar_off, +sidecar_len)    ordinal -> {key, hlc, deleted} sidecar

The offset table is direct-addressed: table[Gram] is the byte offset of that gram's posting block within the postings region, or 0 when the gram is absent. Byte 0 of the postings region is a reserved sentinel so a 0 entry is unambiguously "empty". The table spans only up to the highest gram present; a query for any higher gram reads past the table and is treated as empty. The table also serves as the gram directory for all_postings/1.

Each posting block is stored length-prefixed: [Len:32][block] where the block is a delta+varint list of ordinals (see barrel_ngram_postings).

The sidecar maps a local ordinal to its document key, the change HLC that produced it (the recency sequence number used when merging), and a deleted flag (a tombstone: a deleted key carries no grams). The index is [KeyOff:32][KeyLen:32][Deleted:8][Hlc:12] per ordinal, followed by the concatenated key bytes. It is read once at open; key bytes are read on demand with file:pread.

Reads use file:pread and leave caching to the OS/ZFS ARC. Handles carry a raw read fd owned by the opening process, so a query opens its own handle rather than sharing the shard's.