Fix absence-proven provider-session rebinds

[first-assist]

Summary

Allow a durable provider-session tombstone with exact persisted absence evidence and a cleared cursor to start a new generation under the current server-authored descriptor. Historical descriptors continue to fence live cursor resume but no longer strand an already-deleted generation after a reviewed runtime, registration, policy, model, protocol, or capability change.

A lost rebind compare-and-swap now discards the newly created empty provider session and returns a safe deferral before any business input or tool request is sent. Residual deleted tombstones also defer instead of being reported as uncertain provider turns.

The release advances graphql-orm-ai to 0.95.11. Persistent schema module 0.64.0 is unchanged; no data migration is required.

Security boundary

Rebind remains available only after exact provider absence is persisted and the protected cursor is cleared. The replacement path revalidates owner, session, scope, run, attempt, lease, row version, claim generation, cleanup generation, absence evidence, canonical transcript, and the current descriptor atomically before provider input. Live cursor resume still requires a complete descriptor match.

Verification

• focused descriptor-drift rebind regression
• focused compare-and-swap loss/discard/safe-deferral regression
• complete default-feature test suite
• all seven provider feature test lanes
• warnings-denied combined-provider Clippy
• warnings- and missing-docs-denied Rustdoc
• PascalCase GraphQL contract
• PostgreSQL and MSSQL compile-only lanes
• 187-file documentation governance
• release state, package release policy, deterministic release manifest, locked metadata, formatting, and diff hygiene
• 196-check cargo-semver comparison against exact base 7c6720f
• committed-diff neutrality scan

Documentation impact

• Documentation updated
• No documentation impact

Explanation: Updated the crate README, changelog, migration guide, provider-session lifecycle guide, package inventory, version, and matching lock entry.