fix(channels): close residual ~50ms cli elicitation acquisition window with ack handshake

[bug-ops]

Summary

• CliChannel::elicit()/confirm() acquired an ElicitGuard that set a yield_requested flag to pause the background run_tty_reader task, but returned immediately without confirming the reader had actually parked — leaving a bounded ~50ms window (bounded by the reader's event::poll cycle) where both readers could race for the same keystroke on stdin. This was an accepted MVP tradeoff from PR fix(channels): coordinate elicit()/confirm() readline with the background stdin reader #6403 / issue CLI elicitation readline races with background chat-input reader on stdin, causing client-side timeout #6398.
• ElicitGuard::acquire() now awaits a generation-tagged ack Notify: run_tty_reader bumps a parked_generation counter immediately before firing the ack, and acquire() only proceeds once it observes a generation newer than the one captured at entry — closing the window instead of assuming it has elapsed, and correctly rejecting a stale/leftover permit from a previous timed-out acquisition. Bounded by a 200ms timeout so a reader that was never spawned or has already exited cannot hang the caller forever.
• The guard is constructed before the ack-wait await, so cancellation of acquire() at any point always runs Drop and clears the flag.

Test plan

• cargo +nightly fmt --check — clean
• cargo clippy --profile ci --workspace --all-targets --features "desktop,ide,server,chat,pdf,scheduler,testing" -- -D warnings — clean
• cargo nextest run --config-file .github/nextest.toml --workspace --features "desktop,ide,server,chat,pdf,scheduler" --lib --bins -E 'package(zeph-channels)' — 287/287 passed
• Rustdoc gate (RUSTFLAGS="-D warnings" RUSTDOCFLAGS="--deny rustdoc::broken_intra_doc_links") — clean
• 4 new regression tests covering the ack-handshake happy path, no-reader timeout fallback, stale-permit rejection, and cancellation-mid-await flag clearing

Closes #6404