fix: make OPFS finalization and public cache repair failure-atomic

STO-RR-01. finalizePut re-acquired the origin mutation lease it was already
holding. A Web Lock is not reentrant, so an ordinary PUT stopped for good at
FINALIZE; it now calls the locked cleanup directly. A strict non-reentrant fake
lease manager pins one acquire and one release per finalization. The adapter no
longer reports a failed finalization as a plain write success either: the
journal row stays COMMITTED for reconciliation, but the caller is told the
write did not settle.

STO-RR-02. A failure raised while serving a validated request now carries that
request's kind. Defaulting every catch to CAPABILITIES made the client's own
expected-kind check reject genuine quota, integrity and abort failures as
protocol breaches and report them as UNSUPPORTED. Only an envelope the runtime
could not read still answers at protocol level.

STO-RR-03. The worker client decodes a response instead of adopting it: exact
own-data descriptors, the negotiated protocol version, the exact awaited kind,
a code inside the closed BrowserDataFailure set and a boolean retryable. An
accessor, a proxy trap, an inherited or extra field and an unknown code all
close the call as UNSUPPORTED rather than leaving it to time out.

STO-RR-04. A marker read that fails transiently is unknown, not damaged, so it
no longer deletes the candidate that may be serving traffic. Only a confirmed
corrupt or missing marker enters the repair path.

STO-RR-05. Staging never deletes a candidate it did not create. A repair
replaces exact entries in place, so a failed fetch leaves every healthy asset
and the active release usable; a candidate this call created is still removed
on failure.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/adapters/storage/opfs/opfs-worker-runtime.ts

@@ -199,10 +199,15 @@ export function createOpfsWorkerRuntime(
   return Object.freeze({
     async handleRequest(request: unknown) {
       if (!hasRequestId(request)) return null;
+      if (!isWorkerRequest(request)) {
+        // STO-RR-02. Only an envelope this runtime could not read produces a
+        // protocol-level failure. Everything below answers its own request.
+        return failure(
+          request.requestId,
+          mapRuntimeFailure(new OpfsRuntimeFailure("INVALID_INPUT")),
+        );
+      }
       try {
-        if (!isWorkerRequest(request)) {
-          throw new OpfsRuntimeFailure("INVALID_INPUT");
-        }
         switch (request.kind) {
           case "CAPABILITIES":
             return success(request.requestId, request.kind, capabilities);
@@ -289,7 +294,14 @@ export function createOpfsWorkerRuntime(
             );
         }
       } catch (error) {
-        return failure(request.requestId, mapRuntimeFailure(error));
+        // STO-RR-02. The kind travels with the failure so the client's
+        // expected-kind check cannot mistake a quota, integrity or abort
+        // failure for a protocol breach.
+        return failure(
+          request.requestId,
+          mapRuntimeFailure(error),
+          request.kind,
+        );
       }
     },
   });
@@ -911,10 +923,13 @@ export function createOpfsWorkerRuntime(
           await objectDirectory.removeEntry(name, { recursive: true });
         }
       }
-      await cleanupTransaction(descriptor.scope, transactionId, false);
+      // STO-RR-01. This path already holds the origin mutation lease, and a
+      // Web Lock is not reentrant: asking for it again here never returns, so
+      // an ordinary PUT would stop for good at FINALIZE.
+      await cleanupTransactionLocked(descriptor.scope, transactionId, false);
     } catch (error) {
       if (!isNotFound(error)) throw error;
-      await cleanupTransaction(
+      await cleanupTransactionLocked(
         preparedObject.descriptor.scope,
         transactionId,
         false,