fix: retain managed turn through late permissions

[vitry]

Follow-up to #52 for the captured ZCode 0.16.5 resumed-turn permission failure.

Root cause

The managed broker still consumed the legacy prompt_completed notification and detached the active route before the later permission request. The production request also carries requestedAt, which the strict validator did not accept.

Changes

• negotiate exact managed-turn release and keep legacy completion observation non-destructive
• release only at the exact authoritative executor boundary, with owner/socket/input/revision checks and idempotent retry
• drain and deny all same-turn permission tasks to a fixed point before release
• preserve completion timeout/cancellation behavior and fence new sends until release acknowledgement
• cover fresh and resumed captured 0.16.5 ordering, late permission, lost ACK, socket-close, timeout, and compatibility paths
• refresh the marketplace snapshot

Verification

• final Standards review: PASS
• final Spec review: PASS
• npm run check: PASS
  • main suite: 2589 passed, 3 opt-in skipped
  • marketplace build: 2 passed
  • qualified suite: 56 passed, 3 opt-in skipped

No ZCode Rescue invocation was used.