feat(track-a): add canonical live runtime lease manager

[blakinio]

Track A canonical-live controller lease manager, independently reviewed and accepted by coordinator PR #300 as ACCEPT_WITH_EDITS after one material stale-fencing repair.

Purpose

Provide the authoritative serialized controller lease primitive required before PR #311 may enable sequential reuse of one future canonical persistent Track A live Tibia runtime.

Accepted boundary

• production entrypoint: .github/scripts/tibia-official-client-re-canonical-live-lease;
• fixed authority root: /home/runner/_work/_otclient_tibia_re_state/canonical-live-runtime;
• production --state-dir override rejected;
• task capability tokens canonicalized below the claiming task's persistent state;
• stable POSIX flock serializes acquire, renew, validate, release, redacted status and lock-held guard-run;
• atomic mode-0600 shared state contains only a SHA-256 token digest;
• expiry + explicit reason is required for stale takeover; generation increments fence stale credentials;
• expired holders cannot renew, validate or release their stale generation.

Material review repair

The first handoff was returned for evidence after coordinator source review found that an expired holder could release its stale generation and then reacquire normally, bypassing the required stale-takeover reason/audit path. Corrected code head e368173086ba8bb1235218b3ec11e046e2c909cb rejects expired release and preserves active/expired state until explicit takeover.

Corrected semantic evidence:

• custom run 31907695244 SUCCESS;
• unit 95067968895 SUCCESS;
• Synology 95067968820 SUCCESS;
• repo CI 31907697738 SUCCESS;
• CI / Required 95068323632 SUCCESS.

Self-hosted proof includes ENTRYPOINT_FENCED, TOKEN_PATH_TRAVERSAL_REJECTED, EXPIRED_RELEASE_REJECTED, STALE_TAKEOVER_REASON_REQUIRED, CONCURRENT_SERIALIZATION_PROVEN and CANONICAL_STATE_UNTOUCHED.

Promotion edits

Coordinator #300 explicitly delegated docs/agents/MODULE_CATALOG.md and docs/agents/CHANGELOG.md to this PR. Both bounded discovery entries are present; their diffs were reviewed and preserve prior content.

Final release head: 5c8c2eee843a5b7222f55093ec1e14bd7e02853b.
Final custom run 31908309213 and repository CI 31908311202 are the remaining exact-head protected merge gates.

Non-claims

• this PR does not create, launch, stop, login, attach to, signal or otherwise mutate a Tibia client;
• it does not create/use the production canonical-live state during validation;
• it does not identify/register a canonical PID, session, display or noVNC mapping;
• :98 remains NOT_PROVEN / NOT_REGISTERED as canonical;
• this is cooperative same-UID programme governance, not a hostile-local-user security boundary;
• canonical live reuse remains disabled until PR docs(track-a): define canonical live runtime lease model #311 is separately reconciled after this manager reaches main.

Task: OTC-20260815-track-a-live-runtime-lease-manager (ready/unassigned).

[blakinio]

Coordinator review finding — MATERIAL / RETURN_FOR_EVIDENCE before promotion.

LeaseManager.release() currently checks status, identity and token but does not reject an expired lease. An expired holder can therefore release its stale generation and immediately acquire again as a normal post-release generation, bypassing the required stale takeover + explicit reason audit path. This weakens the exact stale-fencing contract PR #311 depends on.

Required correction: release must fail closed with lease_expired once expires_at <= now, preserving the expired active record until an explicit stale takeover occurs. Add deterministic regression coverage and a self-hosted marker proving expired release is rejected and takeover reason/generation fencing remains mandatory. Do not enable canonical live reuse until the corrected exact head is revalidated.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5c8c2eee84

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".