Hosted Shell: recover a Workspace lease after incomplete pipe capture #12904

Problem

The explicit private Hosted Shell profile in #12848 can leave a durable Workspace execution lease held indefinitely after an ordinary backgrounded compound command. With cd . && sleep 20 >/dev/null 2>&1 & echo ok, the shell leader exits promptly, but its subshell keeps a captured pipe open past the one-second post-exit drain boundary. The capture is incomplete, the turn becomes recovery-blocked, and every new Session in the same Workspace receives 409 workspace_busy, including file-only Sessions. Real-stack review evidence observed this more than 40 minutes later and in 3 of 6 real-model trials.

The behavior is fail-closed for execution uncertainty, but there is no supported recovery path once the producer has stopped. #12848 is correcting a related misclassification that marked the incomplete pipe storage_failed and discarded its accepted prefix; that diagnostic fix does not release the lease. #12900 addresses the independent duplicate Flyway V16 migration.

Safety boundary and proposed scope

Do not release the Workspace lease merely because the shell leader exited, the original process group was killed, or stdout reached EOF. A controlled POSIX reproduction showed a detached descendant writing to the Workspace after the original process group was killed and the pipe reached EOF. A fix must either provide an execution boundary that can prove all potential writers have stopped, or provide an explicit, audited operator recovery action based on verified quiescence and a compare-and-swap on the exact held lease. Unknown execution and uncertain output must never be replayed as a new Shell invocation.

The follow-up should define the operator-facing recovery steps and avoid widening the public Shell profile until this path is safe. Keep the current fail-closed behavior in #12848 meanwhile.

Acceptance

• Reproduce the compound-command case with the real Broker, worker, SQL Store and a second Session in the same Workspace. Capture a durable, accurate reason and make the recovery action available after verified quiescence; a new Session then proceeds without repeating the original side effect.
• A detached descendant that can still write to the Workspace keeps the fence in place. Killing the original process group and seeing pipe EOF alone must not satisfy recovery.
• Writer loss, Broker/worker crash, activation replacement and restart preserve the same lease identity and never silently release or replay uncertain work.
• Other Workspaces remain usable throughout. Cover MySQL and MariaDB once fix(managed-agent): Move the Session operation migration to V17 #12900 lands.

Related: #12380, #12848, #12766, #12670.