test: qualify capture retention with finite interpreter controls

[EHotwagner]

Pending reads and uncertain closes need finite controls through the actual retained capture interpreter. Add a per-session internal native/clock seam, immediate native result/errno pairing, a post-read original-work check, and ten controlled lifecycle tests using only synthetic descriptors. Production capture and held-root lease behavior retain the existing public signature; test sessions refuse native root duplication. Surface guards reject exported test internals.

Refs #423 (partial C2 source window; the overall issue and physical acceptance remain open).

Validation: static exact seven-path, original signature/test preservation, project XML, new relative links and git diff --check passed. No local CLR/native execution. Normal hosted CI supplies source qualification; physical capture tests retain their existing default pending state. Prior gate timings fit unchanged job budgets; physical blocked-read/uncertain-close acceptance, provider/Verify acceptance, publication and installed adoption are not supplied.

architecture-map: unaffected

First hosted candidate b086c148: required build and advisory API job failed on FS3261 nullable reflection names/type lookup in the added surface guard (run 38688975564). Original logs retained. Successor handles names with Option.ofObj and locates the non-null exported module from its type array; no gate or product contract weakened.

Rebased unchanged seven-path source bytes onto protected main 35da17b1 after #460 installed the canonical routine producer. Prior a112966f passed all source checks (VerifyCommand Debug/Release each 219 passed, 20 physical cases skipped). The rebased head requires its own authentic routine eligibility and required/coherent checks.