fix(scheduler): enforce bounded occurrence identity

[mattebad]

REC-F07

Offline recurrence repair; no device actions, production enablement, registry/policy promotion, or legacy queue adoption.

• Persist reset-wide limits, canonical batch/revision identity, and durable ordinals before claim.
• Preserve occurrence identity through bounded retries and reset crossing; retain timer anchors and reject UTC rollback.
• Require a successful persisted predecessor for batch/revision advancement; reject retired batch IDs and retired revisions, including after restart.
• Freeze the reset limit and report exhaustion across all relevant flows, even if a later projection attempts to increase the limit.
• Keep prior-schema read-only flow/run decoding compatible without migration or writes.
• Reject reset_bounded cadence without a canonical projection rather than falling through to legacy daily scheduling.

Verification

• Independent full reviewer: ACCEPT, all six ticket criteria; review corrections included stale revision replay, mutable reset limit, and multi-flow exhaustion.
• Windows local: 114 focused/boundary/contract tests; 325 selected offline tests; 117 affected caller tests; compileall passed.
• Actual temporary-state restart probe: A0 -> A1 -> A0 leaves ordinal at 2 and returns CLAIM_UNAVAILABLE for replay.
• Actual prior-schema read-only probe: state readable, database bytes unchanged.
• Exact-head Windows/Linux CI required before authorized reviewed admin merge.

F14, D02-D04, R01, and native consumer integration remain held. Original dirty checkout untouched.