fix(revyl): retire lease owners before disposal

TH
5h ago
+558-230

Summary

Revyl kept handing out devices after release started or failed. One lease owner now makes starting, ready, stopping, stop-failed and closed explicit. It retires admission synchronously, shares bounded disposal, retains uncertain cleanup for retry, and disposes late creates once.

Seven files; scope stays within Revyl lifecycle, adjacent tests and its guide. Related: #4102; follows #4130 and #4141. Eager closure is preserved.

Final review round derives disposal's stop budget from the HTTP client's full retry budget plus a margin, preserves typed retirement when a waiting caller gives up, and caches ready-session reuse. Field and callback-signature nits are explained in their threads.

Validation

Base a0e7c7dc239922bf93adaceff20a2f7e78579146; head a8ebe1f45f164249fc8d4a04221000ab1dd9d180; previous reviewed head 240b05012f6895ea90406d974c80102b94745903.

  • Two new regressions fail at the reviewed head and pass here; all 149 Revyl tests pass. Earlier five lifecycle regressions fail against base sources. The early-release stop assertion detects a removed stop call; mutation was reverted.
  • pnpm check:affected --run --head HEAD passed: receipt run-trpcM0, exactCommit=true, checkoutChanged=false; 16,972 unit tests passed, one skipped. Full-repository format passed.
  • Previous live allocation returned HTTP 401 Invalid API key: one rejected create, zero sessions created. Command/release/listing were blocked. Host cleanup had no pending/unknown releases; private-state daemon stop reported known cleanup with no warnings. No new live run this round.
  • CI Integration Tests and Coverage remain required at this head.