Upgrade owned lifetimes

This is a breaking minor release while Arki is pre-1.0. Upgrade @arki/async and @arki/dot together, rebuild packages that emit their types, and typecheck all reverse dependencies.

1. Replace scoped(async scope => ...) with scoped(plan, body). Use resource(open, close), cleanup(close) and child(run) in the plan. The body receives successful resources and an owned signal. For dependent acquisition, nest a second scope inside the first body's closure.
2. Use dynamicScope([YourRefusal, ...]).run(body) only when work is selected at runtime. Supply original canonical definitions; each admitted callback is checked against their inferred failure union. Validate unknown external output before admission. An explicitly unknown body result stays unknown and cannot promise an exact failure union.
3. Move partial provider cleanup into resource descriptors. Return private resource/child plans from boot. Remove the corresponding manual cleanup from legacy disposal hooks to avoid double release. A failed provider never publishes a value.
4. Check isFailure after synchronous configure and awaited boot/start/stop/get/dispose calls. Propagate a refusal unchanged inside the app. At HTTP or process boundaries, translate it into the protocol's safe failure response or unsuccessful exit. Test assertions may use orThrow; a library compatibility wrapper that throws every returned failure defeats the new contract.
5. Derive success shapes with SuccessOf<typeof operation>. Do not annotate an inferred plugin with a two-parameter Plugin type that drops its ownership metadata. Generic wrappers preserve the original plugin type or its inferred ownership parameters.
6. Treat lazy failures as failed attempts. initialized remains false and peek() stays empty. A subsequent explicit get can retry. Disposal closes admission, joins initialization and returns its cached cleanup outcome. lazyOf borrows an existing value and never closes it.
7. Replace assumptions that a timeout ends work. Owned deadlines request cancellation and join admitted work before finalization. Await the original work; an early-returning timeout helper does not own a still-running callback. Test late settlement with MockClock and an explicit completion gate.
8. Read local aggregate members from the inferred ScopeFailed.cause. Public counts survive serialization; private causes do not. Revive with the canonical ScopeFailed definition and handle a summary, without casting it into a local generic aggregate.
9. Let createAppRuntime wait for HMR disposal. A failed release blocks replacement ownership. Handle RuntimeReleaseFailed and RuntimeReplaced at the hosting boundary instead of creating another pool alongside uncertain resources.
10. ProvidesFactories<Needs, Returns> and an explicit defineFeature(...).provides<Returns>(...) type argument now describe raw callback returns, including Promise<T> for an async factory. Service handles and boot callbacks still receive resolved values. Prefer inferring the factory record and deriving wrapper types with typeof factories; a manual annotation using only resolved values must be updated. This keeps contextual provider inference and failure validation on the same source.

The shared lifetime engine applies to app tasks, requests, jobs and workflow attempts. Their transport and durable execution adapters adopt it in their own migration steps. This release does not claim those integrations are already complete. Dot’s managed phases now return inferred failures; see Upgrade typed phases. Request, job and workflow adapters remain separate migration work.