#3 Reclassify executions under the launch permit

Summary

Reclassify execution ownership after acquiring the launch permit so a process created by another runtime during the pre-permit window blocks this runtime's launch.

pre-permit recovery
  -> acquire launch permit
  -> classification-only recovery under permit
  -> reject if launch is no longer safe
  -> final launch check
  -> backend.start()

The under-permit recovery result does not trigger shutdown, signaling, or reconciliation.

Evidence

• Before: Runtime A received a launchable assessment; Runtime B created an execution before A acquired its launch reservation.
• After: Deterministic RuntimeSeamTest observes the competing execution under A's permit, confirms A neither starts nor invokes its shutdown handler, then clears the fake execution and proves a later A launch succeeds.
• IS_COPILOT=true make test passed; git diff --check passed.

Merge Danger

Door: Two-way

Blast Radius: Runtime

Only the runtime launch classification boundary and its regression test change.

---

Summary by cubic

Reclassifies execution ownership after acquiring the launch permit so a process created by another runtime during the pre-permit window blocks this runtime's launch. Previously, a runtime could start its process based on a stale recovery assessment even if another runtime had created an execution in the meantime. The launch path now re-runs recovery classification under the permit and atomically settles a blocked outcome against service cancellation: the first transition (revocation or recovery-blocked commit) wins, and a later cancellation cannot rewrite an already settled recovery failure. The blocked result does not trigger shutdown, signaling, or reconciliation.