[P1] Keep CLI PRD lease acquisition and cleanup in one execution scope

[brAperia2025]

Context: CodeRabbit feedback on upstream PR coleam00#1875 surfaced likely-valid lease lifecycle issues in our fork.

Problems:

• packages/cli/src/commands/workflow.ts acquires resume PRD leases before updateConversation() and hydrateResumableRun(); failures can strand active leases.
• Fresh PRD launches check active leases after isolation/worktree provisioning; failures can leave orphaned isolation state.

Impact:

• P1. Can block future PRD runs or create orphan worktrees/env records.

Acceptance criteria:

• For fresh PRD runs, check active PRD lease before provisioning isolation when codebaseId/prdId are known.
• For resume PRD runs, acquire the lease only after resume hydration and conversation update have succeeded, or add explicit cleanup for all pre-execution failure paths.
• Ensure lease acquisition and updatePrdLeaseForWorkflowResult are paired in a reliable try/finally scope.
• Add regression tests for pre-execution failure paths.

References:

• Inline comment: Merge AISRV Archon state model into dev coleam00/Archon#1875 (comment)
• Review summary: Merge AISRV Archon state model into dev coleam00/Archon#1875 (review)