SourceCheckpoint lease semantics

Chose a lease on one accepted-request checkpoint over an observation watermark because sourceCount describes request reconstruction, not whether historical messages were distilled or stored. claim() and publish() stay in the response’s temporal savepoint so stale requests cannot replace a newer checkpoint or resurrect a deleted owner; completion must release temporary transcript arrays.