#30337 Cloud: add fenced turn rewind client ledger

Adds a typed Rust client and per-turn fence for Cloud whole-machine rewind.

• Auth is supplied by a short-lived owner capability callback; no machine join credential or bearer is persisted in guest state.
• Capture, start, finish, rewind, and authoritative state/list calls validate the machine and generation fence.
• The local ledger deduplicates captures, rejects conflicting retries, and fences stale finishes and replacements.

Validation: cargo check -p acpmux --lib; focused ledger tests are included in cloud_rewind::tests.

Agent session: agent session

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Adds a typed Rust client, local per-turn ledger, and turn capability fence for Cloud whole-machine rewind, connecting the acpmux guest to the platform's capture, rewind, and turn execution APIs.

• Machine ownership auth comes from a short-lived owner capability callback; no machine join credential or capability token is persisted in guest state.
• A CloudTurnEnvelope (with a one-use trc_ execution capability) reaches the daemon via prompt options; the prepare RPC verifies the envelope's scope against the backend before reserving the prompt ID as the turn ID, and abandoned and accepted IDs are retained so retries replay the same turn.
• Snapshot, start, finish, rewind, and state/list calls validate the machine ID and generation fence against the authoritative server; the ledger deduplicates captures and blocks stale finishes and rewinds that don't advance the generation.
• Execution claims and finishes carry a full turn scope bound to a purpose (prepare/execute) and attempt ID, so an accepted replay acknowledges the identity but never authorizes a fresh execution.

New Features

• Claims the trc_ capability immediately before the harness prompt and finishes it with backoff on every exit path, keeping it in memory only.
• Adds agent-session-turn-prepare/agent-session-turn-abandon RPCs, fenced by connection ID; prepares are serialized FIFO, bounded by a deadline, and disconnect or cancel cleanup abandons only that connection's own reservations.
• The rewind capability is advertised only when the Cloud platform origin, workspace, and machine env vars are set.