fix: release prepared replacement cutover leases (#15)

[James3014]

Closes a terminal-hygiene gap exposed while activating the #194/#163 Wave 2 runtime.

A coordination-bound cutover can legitimately close from the already-supported active PREPARED replacement path: exact replacement source/build/capability identity plus an exact positive workspace/agent witness, with no drain or restart markers. The existing terminal lease release operator accepted only the normal drained + scheduled-restart lineage. After the root carrier was revoked, that left an otherwise terminal lease permanently overlapping the cutover state root and blocked the next cutover.

This change keeps one terminal-hygiene authority and permits lease release for either:

• the existing normal completed cutover lineage; or
• an exact positive-witness prepared replacement whose durable terminal finish action matches the approved replacement identity and approved finish pair.

Expired no-effect recovery, unexpected replacement, capability mismatch, observed replacement, supersession, binding repair, wrong replacement instance, wrong witness pair, non-terminal operations, and non-revoked carriers remain fail-closed.

Exact Candidate evidence:

• base cb33bb7c6f200141b9797c56efdaf2964c726dcf
• tested target tree 188388d511019dc6b974e9c8a7fa065ea031b910
• two changed files, zero deletions, zero Core scope escape
• src/carrier-binding.test.ts: 44/44 PASS, including the new prepared-replacement release and wrong replacement-instance negative control
• npm run typecheck: PASS
• npm run build: PASS
• git diff --check: PASS

No database surgery, provider routing, OAuth semantics, cutover target rewriting, restart scheduling, or recovery authority is added.