fix(0.6.0): establish safe persistence failure boundaries - #225

…d cleanup leaks

Round-2 review fixes (safe persistence boundaries):

- persistenceBoundary no longer trusts throwable identity: trusted failures are
  reconstructed as fresh cause-free/suppressed-free fixed-text instances of the
  same semantic class (JDBC cleanup mutates the primary after construction via
  addSuppressed). Contaminated trusted throwables are delivered to the observer
  before reconstruction; clean trusted failures emit no event.
- Cancellation with raw JDBC children (Statement.cancel, rollback, auto-commit
  restore, close) is sanitized: raw graph goes to the observer, the caller-visible
  CancellationException is a fresh fixed-text instance with only a
  SanitizedCleanupDiagnosticException marker. Genuine framework cancellation
  passes through unchanged and emits no diagnostic. Fixed CE message text.
- FileWorkflowLeaseStore.release/deleteCheckpointIfLeaseOwner resolve the path
  inside persistenceBoundary so a throwing WorkflowCheckpointPathStrategy cannot
  escape the boundary.
- JdbcWorkflowLeaseStore fenced save/delete route checkpoint DML failures to the
  checkpoint store's observer with resourceKind=CHECKPOINT via a
  CheckpointDmlFailure marker; lease-row/fence failures stay on the lease channel
  (exactly one event per failing phase).
- requireRecovery/clearRecovery split into LOAD- and SAVE-phase boundaries so a
  load failure is READ_FAILED, not mislabeled WRITE_FAILED.
- defaultPersistenceFailureCode drops the class-name string heuristic; CLAIM/RENEW
  -> WRITE_FAILED, RELEASE -> DELETE_FAILED.
- safeWorkerObservableFailure reconstructs trusted failures instead of passing
  the throwable identity to observers.
- PersistenceSafeFailureBoundaryTest extended to 25 adversarial scenarios:
  cancellation suppressed-graph sanitization, trusted contamination, throwing
  path strategy, phase-aware classification, checkpoint observer routing, and
  cancellation precedence over trusted failures.

…diagnostics, hoisted preconditions

Round-3 review fixes (safe persistence boundaries):

- Cancellation sanitization no longer routes through the diagnostic-delivery
  helper: delivery ends with ensureActive(), which throws under genuine parent
  cancellation before the sanitized CE could escape. A contaminated CE now
  becomes a fresh fixed-text CE with only a SanitizedCleanupDiagnosticException
  marker, thrown immediately; no observer event on the genuine-cancellation
  path (documented contract). Regression added with a genuinely inactive
  coroutine context.
- Lease compound operations (CLAIM/RENEW/RELEASE) classify read-phase failures
  as READ_FAILED via an internal LeaseReadPhaseFailure marker raised by the
  JDBC and file leaf read helpers; the outer operation context is preserved.
- Corrupt checkpoint data inside fenced JDBC DML stays CORRUPTED_DATA
  (WorkflowCheckpointCorruptionException) instead of a generic WRITE/DELETE
  failure; the generic boundary fallback also classifies internal corrupt
  carriers so no call site depends on passing a classify lambda.
- Caller/framework preconditions hoisted outside persistence boundaries:
  JDBC fenced save (store-type and DataSource checks), InMemory worker
  heartbeat (unknown worker) and stale-worker threshold validation now surface
  as IllegalArgumentException, matching the delete fence and pre-#225 behavior.
- New public PersistenceCorruptionDetail interface exposes the corrupt raw
  payload to diagnostic observers (additive ABI; internal corrupt carriers
  implement it); caller-visible exceptions stay redacted.
- PersistenceSafeFailureBoundaryTest extended to 33 adversarial scenarios:
  sanitized-cancellation-under-genuine-cancellation, corrupt fenced DML,
  precondition surfacing, external observer corrupt-payload access, and
  lease read-phase classification.

…heartbeat, delete-phase classification

Round-4 review fixes (safe persistence boundaries):

- Cancellation contamination detection is now recursive and cycle-safe:
  hasUnsafeCancellationDetail walks the full cause+suppressed graph, so a
  raw SQLException nested under an inner CancellationException is caught
  and sanitized (previously only direct children were inspected).
- PersistenceCleanupDiagnosticException replaces the process-cleanup marker
  in sanitized cancellation exceptions (no cross-domain 'Process cleanup'
  text on a cancelled JDBC persistence operation).
- updateHeartbeat check-then-update restored as ONE atomic monitor
  operation (round-3 hoisting had introduced an unsynchronized
  LinkedHashMap read and a check-then-act race with unregisterWorker);
  clockMillis stays inside the boundary so user-clock failures are
  sanitized, unknown-worker IllegalArgumentException surfaces unchanged.
- Lease DELETE phases (expired-file cleanup during LOAD/RENEW) classified
  DELETE_FAILED via LeaseDeletePhaseFailure marker, mirroring the
  read-phase fix; outer operation context preserved.
- PersistenceCorruptionDetail KDoc documents that fenced-JDBC corruption
  arrives via the cause chain of CheckpointDmlFailure.
- Recursion guard switched from IdentityHashMap to per-call ArrayList with
  identity comparison: the IdentityHashMap default-arg matched the
  global-state scanner's broad HashMap pattern, producing a false
  NEW_GLOBAL_STATE finding attributed to an unrelated file.
- PersistenceSafeFailureBoundaryTest extended to 40 adversarial scenarios:
  nested-cancellation sanitization, delete/read phase classification,
  atomic heartbeat vs unregister, precondition surfacing.

agy round-4 P3: the atomicity test commented 'heartbeats and unregisters'
but only re-registered. Odd iterations now unregisterWorker before the
heartbeat, exercising the real check-then-act race; observed outcomes stay
success or IllegalArgumentException, never NoSuchElementException.