feat: configure storage writer lease TTL

[smiggleworth]

Summary

• expose FITZ_STORAGE_LEASE_TTL_SECS with the existing 30-second default and safety floor
• pass the configured TTL into Midge so its provider-backed writer heartbeat uses ttl / 3
• cover default, override, below-floor, and malformed values
• document graceful release and the current monotonic/fail-closed lease behavior

Why

The Puma foundation needs to run Fitz with a 59-second writer-lease TTL, reducing steady-state S3 lease coordination while retaining immediate takeover after a successful graceful release.

Linked issues

No linked issue: this is a focused runtime configuration extension requested by the platform owner.

Acceptance audit

• Criterion: Fitz can configure the embedded Midge writer-lease TTL from the environment.
  • Evidence: BootConfig parses FITZ_STORAGE_LEASE_TTL_SECS and build_midge_open_options passes the resulting duration to OpenOptionsBuilder::lease_ttl.
  • Production entry point: BootConfig::default -> StorageConfig::validate -> build_midge_open_options.
  • Resolution: implemented with a 30-second default and minimum.
• Criterion: invalid values fail startup rather than silently falling back.
  • Evidence: focused tests cover a value below the safety floor and a non-numeric value.
  • Production entry point: StorageConfig::validate.
  • Resolution: validation returns explicit configuration errors.
• Criterion: operational documentation accurately describes graceful and ungraceful takeover.
  • Evidence: the variable catalog, cloud setup guide, runbook, observability guide, and architecture guide are updated together.
  • Production entry point: operator configuration and shutdown procedures.
  • Resolution: documented that graceful release conditionally expires the lease immediately while crash recovery remains TTL plus skew bounded.

Verification

• cargo fmt --all -- --check
• cargo test --locked --workspace
• cargo clippy --locked --workspace --all-targets --all-features -- -D warnings -D clippy::pedantic
• cntryl-tools validate-docs --config .cntryl/repository.toml
• cntryl-tools validate-benchmarks --config .cntryl/repository.toml
• cntryl-tools check-module-sizes --config .cntryl/repository.toml
• git diff --check

AI assistance disclosure

OpenAI Codex assisted with tracing the pinned Midge lease lifecycle, implementing the configuration plumbing and tests, updating documentation, and running validation. The complete diff and the upstream acquisition, renewal, fencing, and release paths were reviewed before submission.