fix: keep maintenance recovery moving across policy and release mismatches

[hannesrudolph]

What Problem This Solves

Fixes two review findings from #242: an old policy binding could repeatedly block retirement of otherwise eligible requests, and the main completion path could discard pending ownership without validating the broker release response.

User Impact

Recovery keeps incompatible requests and unconfirmed releases owned, while allowing valid work to finish. The archive, cap, budgets and schedules are unchanged.

Why This Change Was Made

Skip old-policy entries in the current zero-scope proof. Require both released status and the exact request digest before advancing the main completion checkpoint.

Evidence

• Both regressions fail against fix: resume native maintenance when retained requests fill the cap #242 before these changes.
• All 58 focused maintenance tests pass, covering mixed policy bindings, replay after scope retirement, invalid release status/digest, and successful release retry from durable intent.
• Exact final diff review is clean (no accepted/actionable findings). The executable entrypoint mode is preserved.
• Immutable installed bundle matches the reviewed source hashes. Registration exited cleanly under the maintenance lock; core PID, metrics, portable job, 900-second cadence and held capture files were preserved. Installed ordinary controller acceptance published run 213: 19 repairs, 5,340 clusters / 9,579 members, with the exact broker release response validated. Read-only eligibility at 16:45:23 UTC returned zero due tasks; retained/pending envelopes are zero. Core completed normally after restoration at 16:46:30 UTC.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review in progress

ClawSweeper is reviewing this revision. This supersedes any previous blocked status.

View the workflow run.