fix(daemon): stop provider lease releases after shutdown closes the releaser
Summary
createExpiredProviderLeaseReleaser spread shutdown state over flags, timers and maps, so nothing owned the transition: a release outliving drain()'s budget survived shutdown() and plugin dispose, and its failure re-armed a provider call on a disposed runtime. The module now owns one phase — running / draining / closed — advanced only by advancePhase. closed starts no provider attempt, arms no timer, and admits no pending work: release() answers a typed outcome (released / retrying / not-required / refused + reason + durable), which both callers report. A recoverable lease still gets its record written for the next daemon; ADR 0007 records that boundary.
Validation
Lease suites, disposable checkout: base f7879cf2d2 6 failed | 17 passed; reviewed head 74e46b9eb2 5 failed | 18 passed, failing for the review's reason; head 45787dd057 green. Unit 16752 and daemon + host-kit 4334 pass. Gate check:affected --run --head 45787dd057: passed, exactCommit=true, receipt run-hPwNaG.
Live: daemon plus a BrowserStack session whose DELETE a proxy held past the 2s drain budget, then SIGTERM → one provider call, none in the 22s after close. That route's A/B needs limrun (API unresolvable) or revyl (no plugin), so it shows fixed behaviour only. Round 2 changed no device route: no new live run.
Open blocker, cause unproven: Apple smoke failed twice on stop screen recording / xcrun timed out after 30000ms (runs 41291091023, 41295528868 attempt 2); its first attempt failed elsewhere, and each scenario passed in the other attempt. No lease code there.