Centralize user session and policy decisions

[PLN]

User-session request identity, logoff, admission-policy revision/revocation and completed linger mutations/scans now publish through explicit serialized decision handlers. Workers retain token lookup, filesystem work and process cleanup outside the decision lock. Late observations still require the accepted request and policy revision; an accepted persistence mutation remains visible if shutdown starts during its I/O.

The native no-restart fixtures now observe the child start and exit before their absence window. CI exposed the previous fixed-delay assumption on a busy worker. Twenty race repetitions passed; profiling of the separately timed-out journal package passed in 40.558 seconds with the timeout unchanged.

Validation: three focused race repetitions passed before and after integrating reserved linger revocation. The full uncached race suite, vet and Windows/Linux staticcheck passed; the writer documentation link check passed. Final source 2e746a8d792954b54e9109e3701ea8e1581ed6bb passed CI 34764252879. Fourteen cases passed ten repetitions each as SYSTEM and a headless standard user in 11.501/10.707 seconds, without skips and with full process/profile cleanup. Twelve exercise policy/control with delayed adapters; two exercise actual native child exits. Full R2 writer and worker-class acceptance remains open.