Retire RCA package lock authority residue

[gaofeng21cn]

Summary

• remove lock_owner, package_lock_ref, and rollback_ref from the RCA owner descriptor
• state that legacy lock/receipt/LKG/rollback/transaction surfaces are compatibility-to-delete, not Package currentness authority
• add negative no-resurrection guards without changing runtime compatibility code

Verification

• focused descriptor/carrier tests: 5/5
• npm run typecheck
• locked native-extra fast lane: 40/40
• git diff --check