feat(worker): operator surrender lane for unrecoverable ordinary release authority

[ruby-dlee]

Why

All four pilot worker slots are stranded in the same shape: assigned, VM deallocated by TTL, and no sanctioned exit. Their tasks were closed out locally (teardown consumed state/.meta before any receipt existed - the unimplemented D6 ordering), so authority-receipt can never mint a proof, release requires that proof, and withdraw only takes queued entries. The only remaining path was hand-editing controller state.

What

A refusal-first surrender command that replaces the hand edit:

• runs the ordinary release authority FIRST and refuses when it succeeds (surrender cannot become the easy path)
• requires dark compute: the live provider inventory must show the VM deallocated or stopped
• requires --reason, --confirm-surrender, and the exact subscription confirmation (withdraw's bar)
• refuses to replace an ordinary release proof, refuses while a pending provider action exists, and is idempotent on rerun
• mints a fm.worker-release/v2 bundle whose five authority verdicts are 'surrendered' with a top-level surrender block (reason, the ordinary authority's refusal verbatim, power state, last execution digest); release_receipt rejects the 'surrendered' verdict, so the bundle cannot replay through ordinary release
• downstream is untouched: reconcile drives deallocate/delete-compute/reset on the recorded proof exactly as for an ordinary release
• the wrapper removes the task's locally staged provider credential keyed off the FM-SURRENDERED receipt, mirroring the withdraw lane

Verification

• New unit surrender_lane drives the REAL wrapper end to end against the fixture provider: confirmation gates, dark-compute refusal against a running VM, a genuine ordinary-authority refusal, receipt-keyed credential cleanup, digest round-trip, release_receipt rejecting the bundle, idempotent rerun, and full reconcile convergence to zero workers with the queue entry complete.
• New unit surrender_refuses_when_ordinary_authority_passes pins the success gate (module-level substitution of the attempt outcome only; the subprocess contract itself runs for real in surrender_lane).
• Mutations, each turning the suite red and restored from the commit: authority-success gate removed; dark-compute gate removed; proof digest tampered; wrapper credential cleanup dropped; verdict flipped to 'proved'.
• Full tests/fm-worker-lifecycle.test.sh green locally (12 units); bin/fm-lint.sh and fm-behavior-shards.sh --check 8 clean.