fix: bound resumable teardown, image concurrency and delivery leases

TR-RR-06. dispose() now bounds its drain with a cleanupDeadlineMs from policy
and returns the result, so a non-cooperative mutation lock or provider can no
longer make teardown unbounded and an unproved drain is reported as still
CLOSING instead of closed over. The checkpoint store stays open in that case,
because something can still write to it. An abort is admitted physical work
like an upload, so it joins the tracked set rather than being stepped over.

TR-RR-07. The verification slot belongs to the raw verifier, not the wrapper.
Releasing it when the caller's wait expired let an abandoned verification keep
running while a new one was admitted, so repeated aborts produced more
concurrent physical work than the configured cap allows. The slot is now
released only once the raw tasks settle.

TR-RR-04. A presigned byte source owns a fetch reader and a capability lease and
its port requires close(); the delivery consumer never called it. The closeable
subtype is lost in the FileByteSource projection, so a holder keeps it from the
moment the lease exists and the outermost finally closes it exactly once — on
success, validation failure, writer failure and abort alike.

check:adapter-inventory now also fails if the shared abortable-operation
primitive has no production importers. It was safe to add only once the
presigned subsystems actually migrated onto it; a gate that fails CI for a
documented, unfixed defect reports the wrong thing.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/unit/presigned-transfer.test.ts

@@ -1975,6 +1975,114 @@ describe("presigned transfer", () => {
     });
     expect(written).toEqual([...bytes]);
   });
+
+  /**
+   * TR-RR-04. A presigned byte source owns a fetch reader and a capability
+   * lease, and its port requires `close()`. The delivery consumer never called
+   * it, so every outcome — success, validation failure, writer failure and
+   * abort — leaked both.
+   */
+  it.each([
+    { label: "success", mode: "SUCCESS" as const },
+    { label: "writer failure", mode: "WRITER_FAILURE" as const },
+    { label: "abort", mode: "ABORT" as const },
+  ])("closes the presigned source exactly once on $label", async ({ mode }) => {
+    const bytes = new Uint8Array([1, 2, 3]);
+    let closes = 0;
+    const controller = new AbortController();
+    const source = {
+      byteLength: bytes.byteLength,
+      integrity: "VERIFIED_ON_SUCCESSFUL_EXHAUSTION" as const,
+      capability: undefined as never,
+      close() {
+        closes += 1;
+      },
+      async *stream() {
+        if (mode === "ABORT") controller.abort();
+        yield { ok: true as const, value: bytes };
+      },
+    };
+    const capability = Object.freeze({
+      capabilityReceipt: "capability-close-1",
+      method: "GET" as const,
+      binding: { kind: "DOWNLOAD" as const, resourceId: "resource-1" },
+      mediaType: "application/octet-stream",
+      byteLength: bytes.byteLength,
+      maxBytes: bytes.byteLength,
+      expectedSha256: "a".repeat(64),
+      expiresAtEpochMs: NOW + 60_000,
+    });
+    source.capability = capability as never;
+
+    const closePolicy = browserFilePolicyReference(
+      "download",
+      "presigned-close",
+    );
+    const policies = new BrowserFilePolicyRegistry({
+      profiles: [
+        {
+          reference: closePolicy,
+          download: {
+            strategy: "PROMPT_AND_STREAM",
+            mediaType: "application/octet-stream",
+            safeExtension: ".bin",
+            maxTransferBytes: 64,
+            maxBufferedBytes: 8,
+            integrity: "REQUIRED",
+          },
+        },
+      ],
+      hardLimits: {
+        maxInspectionBytes: 64,
+        maxRetainedFileBytes: 64,
+        maxPreviewBytes: 64,
+        maxObjectUrlBytes: 64,
+        maxTransferBytes: 64,
+      },
+    });
+    const handle: SaveFileHandle = {
+      async createWritable() {
+        return new WritableStream<Uint8Array>({
+          write() {
+            if (mode === "WRITER_FAILURE") {
+              throw new TypeError("writer exploded");
+            }
+          },
+        });
+      },
+    };
+    const downloads = createDownloadDeliveryAdapter({
+      host: { handoff() {} },
+      policies,
+      hardMaxObjectUrlBytes: 64,
+      hardMaxTransferBytes: 64,
+      browserManagedCapabilities: {
+        resolve() {
+          throw new TypeError("not used");
+        },
+      },
+      openAuthorizedSource: async () =>
+        ({ ok: true, value: source }) as never,
+      showSaveFilePicker: async () => handle,
+      userActivation: { isActive: true },
+      now: () => NOW,
+    });
+
+    const deliveryResult = await downloads.deliver({
+      policy: closePolicy,
+      source: {
+        kind: "AUTHORIZED_STREAM_RESOURCE",
+        resourceId: "resource-1",
+        capability: capability as never,
+      },
+      suggestedFileName: "artifact.bin",
+      signal: controller.signal,
+      onProgress() {},
+    });
+
+    void deliveryResult;
+    expect(closes).toBe(1);
+  });
 });
 
 /**