refactor: unify terminal owned-resource release

[MarcoPorcellato]

Summary

• Add a private, command-family-neutral terminal finalizer shared by historical
  runs, matrix runs, benchmarks, and guarded execution.
• Enforce completion-before-release, exactly-once admission release, and
  fail-closed release-error precedence while preserving journal, watchdog, and
  cache-pin ordering.
• Document the operator contract and record the change in the changelog.

Trust claim checklist

• Public claims in this pull request do not imply:
  • native execution where only contract-level qualification is available,
  • signed identity or full execution attestation when only A0 evidence is present,
  • zero-cost operation or equivalent absolute cost reductions.
• I described any source, runtime, workflow, permission, secret, policy, schema, or dependency impact below; write none only after checking the diff.
• Roadmap text is presented as planned work, not as implemented or qualified behavior.

Impact and rollback

• Runtime or trust-boundary impact: internal terminal ownership and error
  precedence are unified; CLI, configuration, policy, and receipt schemas are
  unchanged.
• Dependency or supply-chain impact: none.
• Data, secret, permission, or network impact: none.
• Rollback path: revert this pull request to restore the prior per-family
  finalization paths.

Evidence checklist

• Focused deterministic checks covered the terminal primitive (5), run
  finalization (3), cross-family release (1), guard cache-pin lifetime (1),
  early watchdog error (1), existing run behavior (20), resource watchdogs
  (2), process supervision (2), recovery CLI (3), runtime CLI (7), matrix
  contracts (4), and cache-pin contracts (1).
• Rust formatting and strict warnings-denied Clippy passed for all targets
  and features.
• Relevant contract tests passed; the native guard-exec contract remains
  explicitly NOT_RUN (0 passed, 1 ignored).
• The complete diff passes whitespace validation.
• CHANGELOG.md records the user-visible contract change.
• No links were added or changed.

Validation notes

Exact reviewed head: 9ff626ed5c5699c0e6498cc14df22180f9304286.

The complete deterministic suite passed with 374 passed, 3 ignored, and 0
failed across 24 suites. No doctests exist. Native guard-exec qualification is
NOT_RUN; no CCP run, Docker workload, receipt, or native qualification is
claimed by this pull request.