feat: first-class control-plane lease lifecycle (Closes #601)

Make active leases queryable workflow state with canonical adopt, release,
expire/reclaim, and abandon operations on the #613 control-plane DB substrate.

- lease_lifecycle.py: policy, proof gates, safe_next_action vocabulary
- control_plane_db: schema v3 provenance columns + list/inspect/adopt/abandon
- MCP tools: gitea_*_workflow_lease(s) for list/inspect/adopt/release/expire/abandon/reclaim
- issue_lock_store: sanctioned reclaim of expired author locks (dead pid / missing wt)
- Tests cover lifecycle, foreign steal refusal, allocator compatibility, merger handoff

task_capability_map.py

@@ -149,6 +149,65 @@ TASK_CAPABILITY_MAP: dict[str, dict[str, str]] = {
         "permission": "gitea.read",
         "role": "author",
     },
+
+    # #601 first-class lease lifecycle — inspect/list need read; mutations gate on
+    # ownership in the control-plane DB (not a separate Gitea write permission).
+    "list_workflow_leases": {
+        "permission": "gitea.read",
+        "role": "author",
+    },
+    "gitea_list_workflow_leases": {
+        "permission": "gitea.read",
+        "role": "author",
+    },
+    "inspect_workflow_lease": {
+        "permission": "gitea.read",
+        "role": "author",
+    },
+    "gitea_inspect_workflow_lease": {
+        "permission": "gitea.read",
+        "role": "author",
+    },
+    "adopt_workflow_lease": {
+        "permission": "gitea.read",
+        "role": "author",
+    },
+    "gitea_adopt_workflow_lease": {
+        "permission": "gitea.read",
+        "role": "author",
+    },
+    "release_workflow_lease": {
+        "permission": "gitea.read",
+        "role": "author",
+    },
+    "gitea_release_workflow_lease": {
+        "permission": "gitea.read",
+        "role": "author",
+    },
+    "expire_workflow_leases": {
+        "permission": "gitea.read",
+        "role": "author",
+    },
+    "gitea_expire_workflow_leases": {
+        "permission": "gitea.read",
+        "role": "author",
+    },
+    "abandon_workflow_lease": {
+        "permission": "gitea.read",
+        "role": "author",
+    },
+    "gitea_abandon_workflow_lease": {
+        "permission": "gitea.read",
+        "role": "author",
+    },
+    "reclaim_expired_workflow_lease": {
+        "permission": "gitea.read",
+        "role": "author",
+    },
+    "gitea_reclaim_expired_workflow_lease": {
+        "permission": "gitea.read",
+        "role": "author",
+    },
     # #612 incident bridge — reconcile uses create_issue for apply;
     # dry-run needs read only. Tools gate apply paths themselves.
     "observability_reconcile_incident": {