fix(lease): return typed errors for malformed routes

[smiggleworth]

Summary

• allow authenticated malformed Lease ACQUIRE, EXTEND, RELEASE, and QUERY requests to reach domain validation
• return the documented typed 5008 response without touching ownership state
• cover all authenticated exact and observation operations and align the routing status document

Why

The Fitz Destroyer lease-route-aliasing scenario exposed that malformed authenticated exact operations closed the session instead of returning the recoverable Lease error required by the contract. This is a follow-up correction to #219 and was reproduced in https://github.com/cntryl/fitz-destroyer/actions/runs/33666942180/job/100371168318.

Validation

• cargo fmt --all -- --check
• cargo test should_return_typed_error_for_authenticated_malformed_lease_
• cargo test --locked --workspace
• cargo clippy --locked --workspace --all-targets --all-features -- -D warnings -D clippy::pedantic
• Fitz Destroyer lease-route-aliasing against a source-built image: 6 operations, 6 typed rejections, 6 canonical routes preserved

AI assistance

Codex assisted with failure-log analysis, implementation, regression tests, and validation. I reviewed the complete diff and verified it with the repository-required Rust gates and the real Docker scenario.