Fix ZCode 0.16.3 rescue protocol compatibility

[vitry]

Summary

• accept bounded empty session/create snapshots at the managed broker boundary before ownership persistence
• extract completed results through ZCode 0.16.3's distinct request input ID and user message ID linkage
• fail closed on historical, background, orphan, hidden, empty, or ambiguous result roots
• add broker-side mutation tests and full companion distinct-ID coverage

Root cause

The client already accepted the bounded empty create snapshot, but the managed broker still applied the strict post-create snapshot validator and rejected the same response with ZCODE_OUTPUT_INVALID. After crossing that boundary, ZCode 0.16.3 exposed a second mismatch: session/send.inputId is not the new user message ID, while the assistant points to that user message ID. The result extractor treated inputId as the parent message ID and reported ZCODE_RESULT_MISSING.

Verification

• npm run check (1154 pass, 0 fail, 3 qualification-only skips; marketplace build 2/2)
• authenticated local ZCode 0.16.3 probe: managed rescue succeeded and returned the exact requested text; result matched
• command lifecycle probe: foreign-owner result/cancel stayed OWNED_JOB_NOT_FOUND; same-owner queued cancel became cancelled
• independent final review: no Critical, Important, or Minor findings