fix: bound browser transfer leases and effect reporting

BT-X-01: add the shared abortable-operation utility with golden tests for first
terminal owner, idempotent close, listener and timer cleanup under a throwing
scheduler, observed late rejection and late-handle compensation. It carries no
subsystem result taxonomy.

BT-PRE-01: make the presigned download lease lazy and single-start. open() now
validates, claims and consumes the capability without any network I/O; the
fetch, the transfer deadline and the expiry recheck happen at first stream
consumption. The source gained close(), which discards an unused lease with no
I/O and otherwise cancels the body and releases the scope exactly once.

BT-UP-01: require removeEventListener in the AbortSignal structural guard and
isolate release cleanup so a hostile facade cannot replace a typed terminal
result with a rejection.

BT-UP-03: deleteDatabase cannot be cancelled after dispatch, so a blocked
deadline now returns PENDING with effect UNKNOWN instead of a failure that reads
as NOT_APPLIED. A realm-scoped (factory, databaseName) registry prevents
recreating the partition until the native request settles.

BT-UP-04: reject non-finite and negative upload clocks as a dependency failure
instead of letting them bypass every capability expiry comparison.

BT-IMG-02: replace the naive Cache-Control quote stripping with a quote- and
escape-aware tokenizer, so max-age="60 or 60" is no longer read as 60 and a
comma inside a quoted extension is not a directive boundary.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/unit/resumable-upload-checkpoint.test.ts

@@ -183,7 +183,7 @@ describe("IndexedDB resumable upload checkpoint", () => {
     ).toMatchObject({ ok: true });
     expect(await runtime.admin.deletePartition()).toEqual({
       ok: true,
-      value: { state: "DELETED" },
+      value: { state: "DELETED", effect: "APPLIED" },
     });
     expect(await runtime.store.read("upload_key_01")).toMatchObject({
       ok: false,
@@ -191,21 +191,48 @@ describe("IndexedDB resumable upload checkpoint", () => {
     });
   });
 
-  it("bounds a partition deletion blocked by another browser context", async () => {
+  it("returns PENDING UNKNOWN when deleteDatabase is still blocked", async () => {
     const memory = new MemoryIndexedDbFactory();
+    const factory = deletingFactory(memory, "BLOCKED");
     const runtime = createIndexedDbResumableUploadCheckpointRuntime({
       scope,
-      factory: deletingFactory(memory, "BLOCKED"),
+      factory,
+      blockedTimeoutMs: 1,
+    });
+    // BT-UP-03. The native request is still live, so the deadline is not
+    // evidence that nothing happened.
+    expect(await runtime.admin.deletePartition()).toEqual({
+      ok: true,
+      value: {
+        state: "PENDING",
+        effect: "UNKNOWN",
+        reason: "BLOCKED_DEADLINE",
+      },
+    });
+  });
+
+  it("keeps the checkpoint store closed until a pending delete is resolved externally", async () => {
+    const memory = new MemoryIndexedDbFactory();
+    const factory = deletingFactory(memory, "BLOCKED");
+    const runtime = createIndexedDbResumableUploadCheckpointRuntime({
+      scope,
+      factory,
       blockedTimeoutMs: 1,
     });
     expect(await runtime.admin.deletePartition()).toMatchObject({
-      ok: false,
-      error: {
-        code: "BLOCKED",
-        retryable: true,
-        recovery: "RELOAD_OTHER_CONTEXTS",
-      },
+      ok: true,
+      value: { state: "PENDING" },
     });
+
+    // A second runtime over the same realm and database would race an unknown
+    // native effect.
+    expect(() =>
+      createIndexedDbResumableUploadCheckpointRuntime({
+        scope,
+        factory,
+        blockedTimeoutMs: 1,
+      }),
+    ).toThrow(TypeError);
   });
 
   it("never reports a false abort after irreversible deleteDatabase dispatch", async () => {
@@ -219,7 +246,7 @@ describe("IndexedDB resumable upload checkpoint", () => {
     controller.abort();
     expect(await deletion).toEqual({
       ok: true,
-      value: { state: "DELETED" },
+      value: { state: "DELETED", effect: "APPLIED" },
     });
 
     const preAborted = new AbortController();