fix(queue): make Redis authoritative for retry deadlines

[Joncallim]

Source Issue

Issue: #179

Summary

Retry scheduling uses Redis as its sole clock authority, and retry-v3 now rejects an exact retry destination that coexists with a live owned processing source.

• Workers send only a relative delay; Redis TIME authors the stored absolute deadline.
• Applied and exact lost-response replay results return the exact stored Redis score.
• Runtime persists that returned timestamp to task-attempt history.
• Task, approval, and answers queues share the same exact-destination guard.

Fail-closed boundaries

• In the live-source plus exact-owned-marker branch, retry-v3 checks ZSCORE before LREM, HDEL, or ZADD.
• An existing exact destination returns stale_not_owner and preserves the source, live claim marker, destination member, and destination score.
• A wrong-type destination key aborts before any state mutation.
• Unrelated retry members do not block a valid owned transition and remain unchanged.
• Source-absent exact lost-response replay remains authorized only through its existing exact destination discriminator.
• Delay validation, promotion receipts, recovery, ownership, and non-disclosure behavior remain unchanged.

Validation

• Focused queue/runtime tests: 20/20 passed.
• Disposable Redis 8.8 proof: 3/3 passed with QUEUE_OCCURRENCE_REDIS_MULTIPLICITY_OK, QUEUE_OCCURRENCE_REDIS_RECOVERY_OK, and QUEUE_OCCURRENCE_REDIS_SHUTDOWN_OK.
• Real Redis covers live exact-source/marker/destination conflicts for task, approval, and answers queues; wrong-type destination keys; unrelated-neighbor success; and source-absent response-loss replay.
• Full local unit command: 1,687 passed with 10 locally gated service tests skipped.
• ESLint, npx tsc --noEmit, production build, and git diff --check passed.
• Negative mutations failed when the guard was removed, moved after destructive commands, or the live marker was deleted from the test. All mutations were restored.

Stack boundary

This draft targets codex/pr198-producer-5a2-r3a-retry-upgrade at exact parent head dbdd43c3487b0429cb4758919185188a802babe0.

It addresses the retry destination-guard amendment within the clock-authority slice. The v2 rolling-deployment cutover thread, R3B, R3C, and R3D remain out of scope and paused.