Add active-turn leases and abandoned-turn recovery

[ajac-zero]

Problem

Threadmark permits only one pending or streaming turn per conversation. If an agent runtime crashes after atomic turn start, the active turn can remain indefinitely and block all future turns in that conversation.

Proposed change

Add a bounded ownership/recovery mechanism for agent turns. A lease-based design should include:

• lease_expires_at on active delegated turns
• a lease duration compatible with the agent maximum run timeout
• optional authenticated renewal/heartbeat
• automatic or explicit transition of expired turns to cancelled or failed with a stable reason such as agent_lease_expired
• rejection of late finalization after another operation has recovered or superseded the turn
• an idempotent reconciliation path for a runtime restarting after an unknown start/finalize outcome

Any background cleanup must preserve the one-active-turn invariant and race safely with finalization and renewal.

Acceptance criteria

• An abandoned active turn cannot block a conversation forever.
• Finalization, renewal, and expiry races have deterministic single-winner behavior.
• Exact reconciliation can determine whether start or finalization committed.
• Late writes and late finalization are rejected after expiry.
• Lease timing, clock assumptions, cleanup ownership, and terminal error representation are documented.
• Tests cover crash abandonment, expiry, renewal, finalization at the boundary, concurrent recovery, and service restart.

Integration context

Bonsai currently cancels execution when a streaming body is dropped, so Threadmark needs a durable recovery rule for turns that were started but never finalized.

[dispatch-developer]

Hard: requires durable lease semantics and race-safe, single-winner recovery across start, renewal, expiry, finalization, and restart paths.