feat(worker): run provider mutations outside the fleet lock under per-slot leases (C2 3 of 3)

[ruby-dlee]

What

C2's final change, per C2-DESIGN.md section 3, shipped as ONE PR as the design requires: a half-serialized controller in which some commands hold the fleet lock across provider calls and others do not is worse than either end state.

• slot_lease: non-blocking per-slot flock; the ONLY waited-on lock in the system stays the fleet lock, making deadlock impossible. The kernel drops a dead owner's lease, which is what makes its claim drainable at once.
• provider_mutate is the only mutate path (provider_call refuses 'mutate'); it requires a live lease on the exact slot.
• claim_pending (durable claim before the provider; refuses a different key on a claimed slot, closing the blind-overwrite/double-guest-run defect), apply_pending (fresh load, claim re-check, transactional apply, pop, save), drain_pending (post-convergence, live-owner skip, stale-snapshot re-read, strict/lenient modes).
• reconcile: inventory unlocked, plan+claim in one short hold, mutate unlocked, apply in a fresh hold, refusals recorded on a CLEAN load; drain runs AFTER convergence so a wedged replay cannot stop the fleet. Planner and classification refresh skip claimed slots. Worst lock holds drop from ~8h25m (execute) to milliseconds.
• abandon-claim: the sanctioned, evidence-preserving exit from a deterministically refused claim (the version-skew execute is the recorded case; the old exit was the blind overwrite). It replays the mutation itself under the lease, requires the result to bind the exact key - proving the mutation complete and its result final under key-idempotency - records the refusal verbatim with the result digest, then clears the claim.
• Capacity commands deliberately keep their single holds (merged_specialized_reservations ignores non-reserved locals; splitting them double-admits real money). execute_action and replay_pending are deleted; resume drains only its own slot, strictly.

Verification

18 units green. New proofs:

• concurrent_mutations_do_not_serialize: two reconciles park two creates INSIDE the provider on a real FIFO rendezvous (arrival = O_EXCL file per idempotency key); asserts two map claims with distinct assignment generations, both leases held in status --json, readers and unrelated withdraw proceeding while parked, exactly one provider call per key after release, and a ONE-child positive control that must fail the two-arrival wait. Structurally unsatisfiable under the old fleet lock.
• wedged_slot_does_not_stop_the_fleet: a guaranteed-refusing claim is reported replay-refused and retained while a queued task still gets its worker; plus the planner never proposes a mutation for a claimed slot even when its released worker is otherwise due destruction.
• The e2e models the real recovery for a version-skewed execute: the retry refuses ('still has an unapplied execute action'), a wrong key refuses abandon, abandon-claim clears it with the refusal recorded, then the retry lands.
• The call-site unit drives the real claim/mutate/apply/drain chain at the raw provider boundary: mutate ban, durable-claim-before-provider from the FILE, different-key refusal, wrong-lease refusal, failed apply leaving the point-3 image intact on disk, lenient drain retaining refused claims, honest drain clearing them, and stale apply refused after the claim is gone.

Mutations against the committed tree, each red: claim different-key refusal dropped; apply_pending claim re-check dropped (survived the first sweep, pinned by the stale-apply probe); drain dropping refused claims; planner claimed-slot skip dropped (survived the first sweep, pinned by the released-worker plan probe); mutate ban dropped; lease slot binding dropped; abandon-claim key match dropped.

bin/fm-lint.sh clean; fm-behavior-shards.sh --check 8 clean (file duration re-budgeted 8000->12000ms).