Harden recovery, delivery safety, and owner-scoped associations

[crypt0rr]

What changed

Implements the v0.42–v0.44 reliability follow-up:

• Adds durable leases and crash recovery for manual syncs and notification/digest delivery.
• Makes delivery fan-out at-least-once and preserves blocked work for paused or unsupported destinations.
• Adds destination transport policy enforcement, reset-token redaction, rate limits, and Shoutrrr transport isolation.
• Adds owner-scoped release-credit visibility and assurance indexes.
• Improves provider cooldowns, fallback scheduling, cache limits, diagnostics, and readiness reporting.
• Adds backup/restore validation, immutable-image checks, integrity checks, logical state fingerprints, and persistent-volume smoke coverage.
• Fixes the restore fingerprint rehearsal so SQLite failures cannot be masked by quoting, heredoc, or pipeline errors.

Why

The review identified reliability gaps around crash recovery, paused destinations, provider outages, backup verification, owner-scoped credits, and transport safety. These changes preserve existing routes, release semantics, deduplication, ownership, and notification timing while making those paths recoverable and observable.

Validation

• go test ./... -count=1
• go vet ./...
• make fmt-check tooling-check lint vuln
• Shell syntax and git diff --check
• Docker restore rehearsal with an immutable image digest, readiness checks, SQLite integrity/foreign-key checks, encryption-key startup, and restart state fingerprint verification