fix(goal): centralize transitions and session automation lease

[LeXwDeX]

Problem

Goal currently has two P1 correctness risks and two P2 terminal-state risks.

• P1: pause/clear and GoalLoop perform unversioned overwrite writes. A valid race can resurrect a paused or cleared Goal.
• P1: GoalLoop and DagLoop can both automatically drive the same Session. There is no automation lease or mutual-exclusion policy.
• P2: Judge maps blocked/unachievable outcomes to success, so the final UI can report achieved incorrectly.
• P2: done persistence and cleanup are separate writes; a crash between them leaves a terminal row that is never processed again.

Scope

• Introduce one versioned Goal transition authority with compare-and-swap semantics.
• Define one Session automation lease shared by GoalLoop and DagLoop.
• Separate achieved, blocked, unachievable, paused, and cleared terminal meanings.
• Make terminal persistence and loop cleanup atomic or idempotently recoverable.

Required tests

• Concurrent pause/clear versus GoalLoop transition cannot resurrect state.
• GoalLoop and DagLoop cannot own the same Session concurrently.
• blocked and unachievable never render as achieved.
• Crash between terminal persistence and cleanup recovers deterministically.

Exclusions

• Project-owned Memory migration and cross-process commit protocol.
• DagLoop 1,296-line change-locality refactor.
• Workflow Authoring changes, which passed the architecture review.

[LeXwDeX]

已关闭：PR #235（五簇 A-E + 双轴深审修复，dev@4fc8515）。Spec 深审五不变量全 HOLD、0 P1/P2；Standards 3 P2 已关；3 个 bounded residual 触发条件已登记。