#4158 refactor(providers): share one lease table across cloud providers

Summary

Revyl's lease bookkeeping moves to a shared table, @agent-device/provision-kit/provider-lease-table. Revyl supplies start, stop, find-by-lease, a rental key and errors. providerRuntimeInstance(provider, fields) joins providerRuntimeOwner; digests are unchanged. ADRs 0007 and 0019 record this. 22 files, 28 self-contained commits.

The table owns:

• One phase per lease (starting → ready → ending) with a generation, re-checked after every await; one start per lease id.
• One teardown per lease, shared by release, recovery, failed start and shutdown; it fences allocations and forgets the lease only once every stop confirms.
• Early rental publication and bounded answer and stop waits, so Limrun can migrate without regressing #4141.

Revyl changes:

• A caller with no deadline waits at most 370 s.
• An allocation or a waiting caller overtaken by a release is refused (provider-lease-releasing), not handed a stopped session.
• The runtime instance is now 32 bytes. Nothing durable keys on it, #4108 journals included.

Limrun moves onto the table in a follow-up now #4141 merged (Refs, not Fixes). Fallow's one clone group (platform-loader glue) predates this PR and sits in Limrun's runtime.ts, which #4141 rewrote.

Refs #4102

Validation

Head c8d45845c7:

• 23 table tests, 400 seeded interleavings, the Revyl suite; live Revyl runs (at dce5c56de0) in the PR comments.
• Limrun digests, pinned through its wrapper, match main.
• check:affected --run --head c8d45845c7 passed, exactCommit=true, receipt run-ZuYyAR. Local Fallow audit: 0 findings.

🤖 Generated with Claude Code