Preserve candidates across ownership reuse and cleanup

[chubes4]

Closes #1214

Summary

• clear prior terminal and PR authority when a clean existing worktree is claimed by a new owner, while preserving explicit ownership lineage
• bind new finalization evidence to the current owner and reject terminal evidence that predates or belongs to a superseded owner
• fail closed before normal cleanup removal unless the exact candidate commit is preserved and verified under an immutable refs/dmc/recovery/<commit> ref
• return deterministic reconstruction and explicit recovery-ref disposal commands in cleanup evidence

Verification

• php tests/worktree-retention-apply-protections.php
• php tests/bounded-cleanup-processed-candidates.php
• php tests/worktree-cleanup-recovery-ref.php (real Git removal, branch deletion, reconstruction, and exact HEAD verification)
• php tests/worktree-cleanup-candidate-classifier.php
• php tests/worktree-lifecycle-state-projection.php
• php tests/worktree-metadata-reconciliation-finalizer-contract.php
• php tests/smoke-cleanup-eligible-drain.php
• php tests/worktree-cleanup-patch-equivalence.php
• php tests/worktree-emergency-cleanup-lock-reactivation.php
• php tests/cleanup-retention-plan-worktree-removals.php
• php tests/worktree-cleanup-eligible-drain-output.php
• php tests/bounded-cleanup-repository-scope.php
• changed-file PHP syntax checks
• git diff --check

Existing Test Failure

php tests/worktree-add-lifecycle.php reaches the pre-existing partial success omitted its exact read-only continuation assertion. The same failure was reproduced on the separate #1212 branch without this PR; all #1214 assertions execute before that baseline failure.

AI Assistance

OpenAI GPT-5.6 Sol via OpenCode reviewed the partial candidate, traced ownership and cleanup authority across lifecycle paths, implemented the durable Git recovery boundary, added the real reconstruction proof, and ran the listed gates under human orchestration.