#3619 fix(lease): return a retried allocation's own lease and refuse an unbound renewed lease

Follow-up to #3487, which merged before these review threads were answered.

• A retried lease allocation that names its own lease id now gets that lease back before the daemon picks a device. Before, the retry failed with DEVICE_NOT_FOUND when the leased device had left the inventory, or with LEASE_ID_IN_USE when the spec now matched another device. The registry's new renewRequestedLease refreshes the live lease when tenant, run, backend, provider and client match; the lease id is the retry key because one run can hold several leases.
• open on a renewed lease that names no device now fails with UNAUTHORIZED / LEASE_SCOPE_MISMATCH and never releases that lease. Only a lease supplied from outside can lack a device key; before this fix open ran on a locally picked device that lease did not bind. This matches the behavior before #3487.
• capture-kit validates envelope device targets with the kernel's isDeviceTarget instead of a private copy.
• The lease handler test helper asserts that a lease came back.

Docs: remote-proxy.md and client-api.md describe the retry behavior and the refused keyless lease.

Checks: build, typecheck, lint, layering, fallow, wire-compat (protocol unchanged), the eager-closure budgets, and the lease handler, registry, lease-scope, remote-connection and capture-kit envelope tests. Each new test fails without its fix.