fix: recover exited and unlaunched bridges with dead owners

[roodboi]

Dead-foreground recovery previously refused a ready graph when a bridge helper had exited or a reserved bridge had never launched. Operators had to release those reservations separately before retrying recovery.

This change journals the exact same-boot receipt, owner witnesses and bridge inventory before normalizing proven exited or never-launched owned reservations. It resumes interrupted stop/removal, including canonical pending guest fences and partial allocation removal. An unchanged originally live bridge can be selected later if fresh evidence proves it exited before main recovery enrollment. Starting, foreign, replaced, newly added or uncertain reservations still refuse; existing main-intent recovery remains unchanged.

Validation:

• Independent source review completed; reported interruption and late-exit gaps addressed.
• Two isolated native fixtures passed: exited plus reserved bridge (7.76 s), and an originally live bridge exiting after selection (8.59 s). Both exercise interrupted fence writes, socket/owner unlink, registry removal and completion; retain named-data markers and a live unbridged sibling; remove their own graphs through guarded cleanup. All preexisting graph-state hashes were unchanged.
• Portable pending-fence contract: 2 passed, including malformed/mismatched refusal and no-write assertions.
• Staged privacy check passed. Pinned Bun typecheck/check/test gates passed using valid existing Turbo cache (no TypeScript changes).
• Full Rust suites passed: default 1,099 passed / 63 ignored; all features 1,198 passed / 94 ignored. Both all-targets Clippy configurations pass with warnings denied, and rustfmt passes. The final test-only CLI/audit addition passed focused tests and both Clippy configurations; it adds one ignored audit helper.
• A fresh native late-exit fixture used the actual current hack-native graph recover-live-owner command for its final positive recovery (9.32 s). It returned stopped-data-retained before guarded data removal.
• Read-only audits of all eight synthetic graphs confirmed engine resource absence, removed guest allocations, and the selected helpers exited/non-live (same-start zombies are accepted as exited). All existing graph-state hashes remained unchanged. Hosted CI is a separate exact-head gate.

Release signal: fix for native retained-graph recovery. This does not qualify application/browser acceptance or simultaneous bridged siblings. Starting reservations remain explicitly unsupported by this normalization path.

Tracks HACK-1226.