feat(recovery): stale worktree binding demotion and crash-orphan lease recovery (Closes #702)

An unhandled daemon crash skips teardown: the durable reviewer lease
comment survives, the in-memory session lease dies, and the
auto-reconnected daemon inherits a stale GITEA_ACTIVE_WORKTREE from its
parent environment (PR #701 / branches/review-pr-654 incident).

AC2 — safe clear/re-bind of stale bindings:
- new stale_binding_recovery.py: classifies the active env binding
  (corroborated / unverified_inherited / provably_stale_missing_path /
  superseded_by_session_lease) and produces a fail-closed recovery plan;
  only provably stale bindings are clear-eligible
- gitea_resolve_task_capability and daemon boot run the sanctioned
  recovery (durable audit via session state); runtime context surfaces
  the classification read-only
- namespace_workspace_binding.resolve_namespace_workspace(verify_paths=…)
  demotes env-bound worktrees whose path no longer exists; mutation and
  runtime-context resolution always verify

AC3 — recoverable lease cleanup after unexpected exit:
- durable session-lease shadow (KIND_REVIEWER_SESSION_LEASE) written on
  sanctioned record/heartbeat, removed on sanctioned clear; a crash
  leaves provable orphan evidence (owner pid + session id)
- assess_crashed_session_lease_orphan derives tri-state
  owner_process_alive: only a dead recorded owner pid proves exit; PID
  liveness is never ownership proof
- diagnose/cleanup wrappers consume the shadow instead of passing
  owner_process_alive=None
- new classification orphaned_expired_superseded_head: an expired
  superseded-head lease with no terminal review stops being a permanent
  ambiguous/wait; post-expiry it unlocks fresh acquisition, and guarded
  cleanup becomes eligible only with owner-exit evidence + clean/absent
  worktree + controller authorization + confirmation. Pre-expiry
  behavior is unchanged (fail-closed wait, no steal).

Validation: tests/test_issue_702_stale_binding_lease_recovery.py (29
tests covering lost in-session leases, old-head leases, runtime/worktree
mismatch, managed reconnect, safe expiry); full suite 2665 passed,
6 skipped, 161 subtests.

Co-Authored-By: Claude Fable 5 <[email protected]>

tests/test_issue_691_obsolete_reviewer_lease_cleanup.py

@@ -561,12 +561,29 @@ class TestIssue691SupersededHeadCleanup(unittest.TestCase):
         self.assertTrue(any("owns the lease" in r for r in result["reasons"]))
 
     def test_superseded_without_terminal_review_denied(self):
+        # Pre-expiry the missing terminal review is ambiguous (fail closed);
+        # post-expiry with unknown owner evidence it is a crash-orphan (#702)
+        # that still fails closed until owner-process exit is proven.
         now = datetime(2026, 7, 13, 5, 0, 0, tzinfo=timezone.utc)
         expires = datetime(2026, 7, 13, 4, 23, 0, tzinfo=timezone.utc)
         claim = _lease_comment(expires_at=expires, last_activity=expires - timedelta(hours=1))
-        result = _assess([claim], formal_reviews=[], now=now)
+        result = _assess(
+            [claim], formal_reviews=[], now=now, owner_process_alive=None
+        )
         self.assertFalse(result["cleanup_allowed"])
-        self.assertEqual(result["classification"], "ambiguous_conflicting_evidence")
+        self.assertEqual(
+            result["classification"], "orphaned_expired_superseded_head"
+        )
+
+        fresh_expires = now + timedelta(minutes=60)
+        fresh = _lease_comment(
+            expires_at=fresh_expires, last_activity=now - timedelta(minutes=5)
+        )
+        pre_expiry = _assess([fresh], formal_reviews=[], now=now)
+        self.assertFalse(pre_expiry["cleanup_allowed"])
+        self.assertEqual(
+            pre_expiry["classification"], "ambiguous_conflicting_evidence"
+        )
 
 
 class TestIssue691DiagnoseClassifications(unittest.TestCase):