feat(ownership): persist optional worker renewal and fenced claim evidence #1251

Readiness correction (2026-10-18): READY, P2. Design PR #1246 is merged; the issue is scoped with concrete acceptance. It does not depend on production OpenCode work or PR-fix reactivation, and those do not depend on it. Let Dispatch's normal priority/aging scheduler decide order. #1254 remains blocked until this work ships.

Why

Persisted agent/* labels and stale claim records are not proof of a live worker; absent worker telemetry is not proof of abandonment. This is a worker-neutral implementation child of #1245 / design PR #1246, not a Courier identity migration.

Work

• Inventory the existing claim/unclaim, Lease, AgentWork, acknowledgements, agent/*, owner/*, linked-PR and status/blockedReason writers; build on them rather than adding a parallel lease system.
• Implement the accepted optional register/renew/terminal-disposition capability for arbitrary workers, with attempt/owner identity fencing, occurrence vs observation times, and durable provenance. A client without it remains supported and conservatively unverified.
• Derive explicit ownership states (active/long-running/review-owned/external wait/held/abandonment candidate/conflicted/unknown) and expose read-only evidence/inspection to operators. A missing heartbeat or renamed label must never by itself revoke ownership.
• Preserve worker identity boundaries: no agent/courier* wildcard alias or silent identity reassignment. Coordinate with existing lifecycle-event foundation #1202 rather than writing duplicate claim histories.

Done when

• Renewal/ack and a legitimate long-running worker remain owned through transient outages and restarts; a stale/incarnation-mismatched renewal is rejected.
• Manual/maintainer hold, linked PR review ownership and external dependency are classified distinctly; conflicting/absent evidence is visible as unknown, not abandoned.
• Tests cover generic non-Courier clients, clients without renewal, stale token, late renewal, replay, worker identity migration and permission boundaries.
• No automatic claim release, requeue, blanket label cleanup or credential rotation in this issue.

Dependencies

Blocked until #1246 is accepted. Claim-release reconciliation is a separate follow-up. #1202 supplies complementary lifecycle evidence but must not become an implicit Courier dependency.