fix: record denied terminal egress outcome

[Brad-Edwards]

Summary

Final flow-sink refusal commits a failed operation and denied audit together, so durable status and caller-visible refusal agree while earlier crossing evidence remains intact.

Requirement UIDs

• (none — bug/refactor/maintenance run; see Traceability section below)

Related Issues

Closes #1358

ADR Impact

• ADR-104
• ADR-101
• ADR-021

Changes

• Classify denied egress through the existing failed sink record before the atomic crossing commit and require successful status for idempotent payload readback.
• Cover denial classes, same-key retry, store reopening, competing claims, and failed commits with runtime regressions; centralize governed replay checks.
• Reconcile the concurrent issue Forward governed invocation context through v2 decision admission #1357 evidence releases and publish new source-bound coverage and formal-semantic captures for the merged implementation.

Test Plan

• Unit tests pass
• Integration tests pass if applicable
• Full completion suite required in CI before merge
• No coverage regression

264 focused tests passed; both current evidence validators and Ruff passed. Repository and artifact policy stages passed locally. Requirement governance cannot resolve a UID for this requirement-free issue and remains a CI gate.

Ground Control Checks

• Repository policy checks required in CI before merge
• Pre-push Codex review completed; all findings fixed or dispositioned

Traceability

• IMPLEMENTS: Issue Commit a denied terminal outcome after final egress refusal #1358 ← implementations/python/packages/raes_runtime/participant_crossing_egress.py, ASR-530 ← docs/research/specification-coverage/bundles/raes-standardized-specification-coverage-issue-1358-v47.json, ASR-530 ← docs/research/formal-semantic-validation/bundles/retest-v47.json
• TESTS: Issue Commit a denied terminal outcome after final egress refusal #1358 ← implementations/python/tests/test_issue_1003_final_sink_flow_enforcement.py, ASR-530 ← implementations/python/tests/test_specification_coverage.py, ASR-530 ← implementations/python/tests/test_formal_semantic_validation.py

Checklist

• Code follows the project's coding standards
• Changelog: owned by Release Please (generated from the Conventional Commit PR title; no per-PR fragment)
• Architectural docs updated if stack, package structure, or key behaviors changed

Documentation

Updated: see diff.

[Brad-Edwards]

Ground Control delivery — this pull request delivers issue #1358; Phase E runs on merge.

[Brad-Edwards]

Ground Control delivery — this pull request delivers issue #1358; Phase E runs on merge.