Session recovery claim semantics

Trap: startup scanning every SessionExecutionTable row as abandoned looks reasonable because a new process cannot see process-local owners, but another node may still be executing. Fix: use durable owner liveness plus lease/epoch fencing; every state transition and provider dispatch must match the execution ID and fencing token and require one affected row, because deleting or replacing a claim alone does not stop a stale runner.