feat(lease): expose managed fencing authority

[smiggleworth]

Summary

• add an immutable LeaseAuthority snapshot to additive managed-lease callback overloads while preserving existing callbacks and legacy ILeaseClient implementations
• expose the final ACQUIRE fencing token, including queued grants, while keeping renewal credential rotation private
• cancel and settle managed callbacks immediately on observed disconnect or renewal loss with deterministic error aggregation
• document the admission-epoch contract and prove package/public-surface and broker handoff behavior

TDD evidence

• red: authority tests failed to compile with CS0246/CS1593 before the API existed
• red: lifecycle regressions failed 3/6 for synchronous pre-await cancellation and synchronous disconnect registration disposal
• green: focused managed lease and compatibility tests 16/16

Validation

• dotnet format Fitz.sln --verify-no-changes --no-restore --severity warn
• dotnet build Fitz.sln -c Release --no-restore (0 warnings/errors)
• non-integration tests 237/237
• complete reconnect/integration suite 267/267
• conformance matrix: TCP/WebSocket x anonymous/JWT, 5/5 tests and 17/17 scenarios per leg
• packed all three packages and built a consumer from a fresh isolated NuGet cache
• independent review: no findings after lifecycle and compatibility fixes

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.