REC-F04: Fence denied lease release

[mattebad]

Scope

REC-F04: fence denied lease cleanup using existing owner/process/lease/run tokens.

• Preserve borrowed leases on denied admission; release a freshly acquired lease once, including after claim rollback.
• Distinguish fresh acquisition atomically from renewal, including stale-snapshot interleavings.
• Fence run-associated release atomically against token drift, retries, and different active runs.
• Preserve successful run-associated cleanup and existing scheduler lease ownership APIs.

Verification

• Independent full reviewer: ACCEPT, all four acceptance criteria.
• 70 focused state/boundary tests passed.
• Selected offline check: 316 tests passed; directly affected suite: 117 passed; compileall passed.
• Temporary-DB probes reproduced then confirmed fixes for invalid admission, run-token drift, and stale acquisition snapshots.
• Committed whitespace check passed. Windows/Linux CI required before merge.

Offline only: no native/device calls, production enablement, registry/policy promotion, or retained-evidence changes. The original dirty checkout remains outside this worktree.