fix: harden queue recovery semantics

[mikehostetler]

Summary

Stacked on #1. This branch is based on intent-ledger/action-hooks; review after or with #1. GitHub could not use #1 as the upstream base because that branch only exists on the fork, and I do not have permission to create the base branch in bedrock-kv/job_queue.

• rollback queue transactions when action hooks fail
• make expired item leases visible/re-leaseable for recovery
• allow supervisors to use a precomputed root keyspace for integration tests
• forward scanner, lease, backoff, and GC options from the supervisor into the consumer runtime
• accept the current Store.extend_lease/5 return shape in the lease extender
• scan raw item ranges for real Bedrock repos while keeping mock/keyspace tests compatible
• add regression coverage for hook rollback, hook action metadata for complete/requeue/snooze/discard outcomes, expired lease visibility, precomputed roots, option forwarding, direct lease-extension return values, and real Bedrock raw range scans

Tests

• mix test

[ccarvalho-eng]

blocking: If callers pass a precomputed root, the consumer starts against that root, but the public JobQueue.enqueue/4 path still resolves its root via Internal.root_keyspace/1. Because this path skips Internal.init_root/2, nothing writes the supplied root into :persistent_term, so enqueue can fall back to Keyspace.new("job_queue/<module>/") while the consumer scans the supplied root. Either cache the provided root here or make the public enqueue/stats path read the same configured root.