Release v19.67.0

Summary

This is the first step of decision 0009: durable application occurrences and UTC schedules. It adds the kernel's storage layer in every provider (InMemory, MongoDB and SQL). Nothing new is exposed to clients or on the wire yet; the kernel occurrence queue, receipts on the wire and the .NET client follow in the next PRs.

Added

• Kernel storage for application occurrences in MongoDB, SQL and InMemory. A replayed ingress id is recognized, and a mismatched payload is refused. (part of #4911)
• Kernel storage for fenced occurrence leases. A worker whose lease epoch has been superseded can no longer renew, complete or fail the occurrence. (part of #4911)
• Kernel storage for schedule definitions and cursors. The start time is written together with the first registration, and each cursor moves forward in versioned, atomic turns. (part of #4911)
• Effect receipts stored in the same transaction as the events they cover, in every provider, including receipts for batches without events. (part of #4911)
• SQL migrations that create the occurrence, schedule and receipt tables when the kernel upgrades. (part of #4911)

Changed

• Decision 0009 now records two clarifications. A unit of work with protected reads and no events stores its receipt through the same validate-only append, so the decision's scopes are still checked. Each schedule cursor tracks the revision registration announced (RegisteredRevision) separately from the one it has applied (AppliedRevision), so a schedule change is migrated exactly once. (part of #4911)