Define Program Intake contract and queue ownership

[yvette-carlisle]

Summary

• Add decodex.program_intake_plan/1 metadata alongside internal Execution Programs.
• Define program node lifecycle/readback states and queue-label ownership evidence.
• Make program-owned queue-label removal fail closed and surface expanded operator counts.
• Update runtime/tracker/operator docs for first-class Program Intake contract boundaries.

Recovery context

Manual takeover for Linear XY-937 retained partial progress from .worktrees/XY-937. This PR uses the original retained runtime branch y/decodex-xy-937 so Decodex review-handoff recovery can bind the PR to the recorded lane.

Supersedes the earlier takeover-only PR #333, which used a non-runtime branch but has the same tree.

Verification

• cargo make fmt
• cargo make lint-fix
• cargo make test
• semantic drift check: searched changed runtime/docs surfaces for stale paused_count/program-intake/readback naming
• tree equality: y/decodex-xy-937 matches the locally and remotely verified takeover commit 004f9a4