SessionExecution lease fencing

Always fence Session execution with durable (sessionID, executionID, ownerID) leases, never process-local ownership. Ordinary acquisition must neither start a second owner during a live lease, re-enter its own uncertain live lease, nor overwrite an expired lease; only recovery may take eligible expired work, never cancellation-phase or superseded work. Exact-owner, unexpired predicates must guard renewal, mutation, publication, dispatch, settlement, cleanup, quarantine, and recovery. Every fenced write requires exactly one affected row; stale work must not overwrite cancellation, emit side effects, revive expiry, or delete successor state.