runtime: close native fleet idle and successor wake races

[cpunion]

Summary

• treat a direct-channel completion that wins between stable idle and the fast worker probe as ready scheduler work
• resolve ordinary clean peer successors against the live route epoch after idle/wake, while keeping baton-backed replacement successors generation-bound
• preserve fail-closed validation for owner state, active reductions, MPSC inbox headers, and replacement lineage
• add deterministic coverage for direct ingress and for peer retirement followed by successor timer park/resume

Root causes

The locked ordinary-suspend fixture could publish a channel completion after standby compatibility but before the optional worker completion probe. The probe treated the now-nonempty direct-channel inbox as corruption instead of returning to the unified reducer.

The locked-G-exit fixture exposed a separate pre-existing race. A permanent clean successor retained the logical epoch from its creation, but a route advances its domain epoch after every idle/wake cycle. The next bounded slice therefore rejected an otherwise valid successor. Ordinary successors now follow the live domain epoch like initial peers; temporary successors carrying a handoff baton still require exact epoch equality.

Validation

• runtime: go test -p=1 ./...
• runtime core: go test -race -p=1 ./internal/coro
• LLVM 22: complete TestCoroNativeFleet suite passed
• LLVM 22: complete TestCoro suite passed in 119.9s
• enhanced peer-retirement regression: unfixed baseline fails in one run; fixed executable passed 1000 consecutive runs
• locked ordinary-suspend executable: 1000 consecutive runs passed
• PR CI: 14/14 checks passed