fix(zig): preserve storage owners and runtime readiness

[ajroetker]

Startup warmup could retire another operation's storage owner, compiled activation could repeat successful work without publishing status, and text planning could treat an ordinary projection revision change as terminal IndexNotFound. Runtime snapshot copies also dropped artifact-source publication proofs, leaving complete indexes stuck at source_observation_incomplete. They also omitted runtime facts and retained diagnostic strings backed by released ABI parsers.

• Make foreground/background residency explicit; observational leases borrow owners. Transient cleanup retires the pinned owner only after borrowers drain, preserving foreground adoption and replacement owners.
• Publish compiled post-reconcile observations through the existing catalog, root, and target fences. Retain busy-group refresh debt and independent sibling observations.
• Refresh same-instance text planning under its analysis lease while retaining replacement rejection and admission revalidation.
• Preserve storage error identities across the callback ABI; report query contention as the existing retryable HTTP 503 outcome.
• Deep-copy per-source replay watermarks, repair facts, and observation counts through runtime snapshots. Stabilize borrowed enrichment and index-lifecycle diagnostic labels before freeing ABI parser storage.
• Preserve value fields automatically in table/index snapshots, with compile-time ownership checks for pointer-bearing fields. Keep merge and graph-metric error names in inline values so cache merges remain allocation-free; preserve their JSON string representation. Complete partial-clone cleanup for optional algebraic diagnostics.
• Retain complete table runtime facts across synthetic refreshes while applying catalog index membership and the existing incarnation fences. Preserve idle owners by their physical identity, independent of workload counters. Root replacement still discards old facts and rejects delayed publications. The merge adds no allocations.

The producer-registry E2E test now verifies durable source readiness and semantic queries through both the producer index and its artifact consumer before and after restart. Runtime batch counters remain runtime-scoped; completed artifacts need not be regenerated to increment a replacement runtime's counters. The stronger readiness assertion fails on the original binary, and the clone regression reproduces the missing source observations. Allocation-failure injection and independent source/cache lifetimes cover cleanup and ownership.

Merged origin/main at 3554f82101. zig/FLAKES.md and zig/e2e/FLAKES.md record CI evidence, deterministic negative controls, and validation provenance. Earlier ownership and planning defects trace to #536 and #502; the exact runtime-replacement timing of the newest CI counter failure was not captured.

Validation on the merged runtime:

• Final native Debug application build: 37/37 steps.
• Current snapshot suite: 112 passed, no leaks, including allocation-failure injection, parser/cache/input lifetime checks, repeated synthetic refreshes, idle owners, catalog membership changes, authoritative updates, root replacement, and existing allocation-free publication checks.
• All three affected E2E modules: 54 passed; the existing opt-in million-chunk scale case skipped.
• Mixed flake soak: 100 repetitions each of full-text chunk routing, artifact coverage after restart, semantic deadlines/cache, packed embeddings, and producer-registry readiness. 500/500 passed, four workers, no skips or failed-case retries.

The final Debug executable was used for both the full modules and the 500-case soak. Negative controls cover owner adoption, activation publication, text planning/replacement, missing source observations, dropped runtime facts, and aliased diagnostic strings. Repository-locked Ruff formatting and lint checks pass.

Local validation is native macOS arm64 Debug. Linux CI must validate the pushed merge revision; no failed-case retries or timeout increases were added.