Return retained mailbox receipts during native Agent receive

[qh-work]

Native recipients can now retain an explicit per-message ACK destination and let ordinary Agent receive return the actual saved mailbox receipt. connect supports register/list/inspect/remove selection actions and direct return_mailbox_receipt. Registration stays local and conveys no disclosure or upload authority; return reauthenticates the saved mailbox and its original independent ACK grants before proving the selected source.

The client persists the original preparation before transmission and reuses the same signed request after a lost reply or restart. Python and TypeScript share the bounded selection/return journals and completed history. Original-root status observations are persisted before denial; an expired retained revocation blocks pending retransmission. Expired uncertain requests become reconciliation_required and stop ordinary polling. Each receive attempts at most two ready returns under its shared deadline. Removing a selection preserves the saved inbox and original return history.

Validation covers actual cold-memory receipt return, lost-response restart, original-sender confirmation, Python reopening native completion, re-registration without another upload, retained revocation and expired-use refusal. Existing native saved-receipt and remote mailbox scenarios, Python ordinary-return recovery, and package/CI inventories are also covered. The HTTP fixture now closes its finished recipient recovery connection before switching runtimes; the cross-runtime checks verify SQLite integrity after each native operation. Final-source complete cloud regression passed 1238 tests across all 139 modules and matched 316 source hashes. All supported Python 3.10 suites and cross-platform conformance passed. Twelve extracted-client checks passed against the exact release archives. Native replica inbox recovery and provisioning remain unfinished.