fix: enforce persistent project controller leases

[Dfskid]

Summary

• enforce one persistent mutating controller per exact workspace across MCP processes
• require explicit owner identity for start, release, abort, and audited dead-controller recovery
• bind lease records to host boot/PID namespace and process birth identity to fence PID reuse
• fail closed on identityless or unprovable claims, running task records, unsafe handoffs, and release failures
• preserve read-only inspection and parallelism across different workspaces

Verification at af99cd8

• uv run pytest -q: 250 passed, 7 skipped
• uv run ruff check .: passed
• uv run mypy src: passed
• focused lease tests: 52 passed

Review status

Draft and blocked. Grok OAuth exact-head review of the prior frozen head completed and identified PID-reuse, empty-runtime, and identityless-recovery risks; those findings are fixed in af99cd8. Two exact-head cross-family reruns at af99cd8 were refused by the CMF machine-load resource guard on a saturated host. Per the founder-approved policy, the infrastructure loop stopped after two failures. This PR must not merge until a fresh Anthropic plus Grok cross-family review completes at the final head and all findings are integrated.

Safety disposition

The remaining reviewer requests for an unaudited force-recovery path were not implemented. Running task records deliberately block recovery, dispatch marks tasks running before worker spawn, and abort/release partial failure remains explicit and audited. These fail-closed choices avoid turning operability shortcuts into workspace-steal paths.