#4108 fix(daemon): recover provider leases a killed daemon left rented

Summary

A daemon killed with kill -9 while it held a cloud provider lease forgot that lease. Live provider leases were kept only in memory, so the rented device stayed billed until the provider's idle timeout.

The lease registry now reports its provider leases whenever one is issued or leaves. The daemon journals the ones that can be recovered in live-provider-leases.json. A lease that leaves for expiry stays in the journal until its expired-lease record is written, and a failed journal write is retried. At startup, any lease in the journal moves into the existing expired-lease recovery, which ends the device. ADR 0007 records the decision and its one gap. This touches 6 files and unblocks the kill -9 evidence on #4092.

Validation

• Tested at 8fd6e2d (base 65ec68b): pnpm check:affected --run passed all runnable checks.
• New tests in provider-lease-expiry.test.ts:
  • A killed daemon's lease is recovered exactly once.
  • A released lease is not recovered.
  • An expired lease stays journaled until its expired record is durable.
  • A failed journal write is retried.
  • Both mutation-checked tests fail without their fix.
• Live on Revyl, with this commit applied to #4092: the daemon was killed at 18:25:49, and Revyl recorded the session completed at 18:25:51.
• Known gap: the registry releases a canceled first allocation without asking the provider. So that lease leaves the journal while its start may still be running, and a crash in that window loses it.

🤖 Generated with Claude Code