fix(macapp): preserve submission-local terminal and failure outcomes after run displacement

[dennisonbertram]

Problem

Independent review of #1129 found two P1 submission-handle ownership failures:

• A terminal followed by B selection can make ToolWalk report A timed out instead of consuming A terminal outcome.
• Late A start/SSE failure after B becomes selected can unconditionally mark B transcript failed.

Acceptance criteria

• Submission handle terminal/failure outcomes are A-local and remain authoritative for A even after B selection; ToolWalk produces correct A verdict, never a false timeout.
• Late A error cannot mutate B visible transcript/lifecycle/error state.
• Deterministic tests: A terminal then B before wait consumes terminal; A start/stream failure after B selected leaves B active/unfailed while A handle resolves failed; no B action/invalid verdict.
• Preserve fix(macapp): clear stale interactive affordances when external run ownership changes #1122/fix(macapp): fence stale stop and steer actions to rendered run identity #1125 guards, fix(macapp): bind composer and ToolWalk lifecycle to submitted run identity #1128 A-only transcript/displacement contract, scheduled B visibility, delayed ACK.
• Sol medium diagnosis, cheap re-review, strict/full Swift/repo/hosted gates.

Scope

Native RunSubmission lifecycle ownership only, stacked after #1129; blocks promotion.

[dennisonbertram]

Implementation plan (stacked on #1128 654b7da): RunSubmission will keep A-local lifecycle separate from a displacement bit; ToolWalk will consume terminal/failure before displacement and use typed outcomes so only a true timeout sends guarded A cancellation. A late startRun acknowledgement must bind the A handle but never select/activate/account it after B selection. Shared visible transcript/error mutations will require exact active-submission identity plus A selection; reset/load detach the handle and EOF fails only its owner. First red tests are barrier-based A terminal->B before wait, late ACK after B, late start/SSE failure after B, reset/load detachment, EOF ownership, and ToolWalk no-B-action/timeout ordering. No server/TUI/callback protocol change.

[dennisonbertram]

Implemented in stacked draft PR #1131 at 8a0334c7. Evidence: strict Swift formatter; focused RunSubmission/ToolWalk 13 tests/2 suites; complete Swift 238 tests/45 suites; retained-pane scripts/test-regression.sh PASS (normal, race, 85.5% total coverage, zero uncovered functions). The first expected red showed late A ACK reselecting A and late A start failure failing visible B. Awaiting independent cheap review and hosted checks; not merged.