fix(crosscheck): shorten allocator release locks

[ruby-dlee]

Summary

• fetch slow Azure inventory outside the global controller lock during capacity release
• reacquire the lock and revalidate the exact reservation, fence, and cleanup receipt before committing
• preserve idempotent concurrent release behavior

Live evidence

A three-run deployed smoke proved reserve inventory now overlaps, then a supported release held the controller lock long enough to time out the surviving admission. This patch closes that remaining lock hold.

Verification

• bash tests/fm-worker-lifecycle.test.sh
• python3 -m py_compile bin/fm-worker-lifecycle.py
• bash -n tests/fm-worker-lifecycle.test.sh
• git diff --check