fix: bound browser transfer leases and effect reporting

BT-X-01: add the shared abortable-operation utility with golden tests for first
terminal owner, idempotent close, listener and timer cleanup under a throwing
scheduler, observed late rejection and late-handle compensation. It carries no
subsystem result taxonomy.

BT-PRE-01: make the presigned download lease lazy and single-start. open() now
validates, claims and consumes the capability without any network I/O; the
fetch, the transfer deadline and the expiry recheck happen at first stream
consumption. The source gained close(), which discards an unused lease with no
I/O and otherwise cancels the body and releases the scope exactly once.

BT-UP-01: require removeEventListener in the AbortSignal structural guard and
isolate release cleanup so a hostile facade cannot replace a typed terminal
result with a rejection.

BT-UP-03: deleteDatabase cannot be cancelled after dispatch, so a blocked
deadline now returns PENDING with effect UNKNOWN instead of a failure that reads
as NOT_APPLIED. A realm-scoped (factory, databaseName) registry prevents
recreating the partition until the native request settles.

BT-UP-04: reject non-finite and negative upload clocks as a dependency failure
instead of letting them bypass every capability expiry comparison.

BT-IMG-02: replace the naive Cache-Control quote stripping with a quote- and
escape-aware tokenizer, so max-age="60 or 60" is no longer read as 60 and a
comma inside a quoted extension is not a directive boundary.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/unit/image-cdn-runtime.test.ts

@@ -1479,6 +1479,10 @@ describe("browser image probe", () => {
       close: vi.fn(),
     }));
     for (const cacheControl of [
+      // BT-IMG-02. Unmatched quotes must not be unwrapped into a bare number.
+      'public, max-age="31536000, immutable',
+      'public, max-age=31536000", immutable',
+      'public, max-age="31536000\\", immutable',
       "public, public, max-age=31536000, immutable",
       "public, max-age=31536000, s-maxage=60, immutable",
       "public, max-age=31536000, immutable, must-revalidate",