Give the execution lease to the composition root and the Worker

[SaladDay]

Part of #1 (store layering), foundation PR 1f. The composition root now owns the execution lease, and store tests get one fixture value to build adapters from.

Execution lease

• New execution.Owner{Lease, Store} and Ownership, which *pgunit.Lease implements.
• cmd/server acquires the lease with pgunit.AcquireLease and passes the same pointer to store.NewExecution(s, lease) and to execution.StartWorker(ctx, dispatcher, owner).
• StartWorker takes over the lease as soon as it is called. A failed start closes it exactly once, and a started Worker closes it after Run drains. Each close gets its own bounded context.
• Execution uses the lease directly. The lease is passed explicitly to the runtime manager, cancellation and RunEnvironmentInput.
• Deleted from store: CheckExecutionOwnership, CancelExecutionOperations, CloseExecution, and store's own lease acquisition.

Store test harness

• fixtureDB{pool, cipher} holds the pool and cipher each test's Store was built from.
• startWorker and startWorkerErr do exactly what cmd/server does, and every StartWorker site uses them.
• publicHandler(t, s, db, keys, engine, …) takes the fixture at all 71 call sites. Later domain cutovers add their adapter inside the fixture without changing call sites.

IMPLEMENTATION.md records the composition and cleanup rule.

Behaviour changes

• A failed start also returns any lease-close error.
• A second Core fails at AcquireLease before it builds a Worker.

Checks

Check	Result
go build ./..., go vet ./services/core/..., gofmt -l, scripts/check-names.py	pass
persistence/...	9 passed
execution/...	201 passed, including new lease tests: start failure closes the lease once, and Run closes it after draining
cmd/...	116 passed
sandbox/providers/...	433 passed
full store package	1038 ran, 12 skipped

The 12 skips need a native daemon or opt-in large storage.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}