fix: record denied terminal egress outcome

[Brad-Edwards]

Summary

Final flow-sink refusal now commits a failed operation and denied audit together, so status matches the caller-visible refusal while earlier crossing evidence remains intact.

Requirement UIDs

• (none — bug/refactor/maintenance run; see Traceability section below)

Related Issues

Closes #1358

ADR Impact

• ADR-104
• ADR-101
• ADR-021

Changes

• Classify denied egress through the existing failed sink record before the atomic crossing commit and require successful status for idempotent payload readback.
• Cover denial classes, same-key retry, store reopening, competing claims, and failed commits with runtime regressions; centralize governed replay checks.
• Publish current source-bound coverage and formal-semantic evidence releases with retained claims; document the behavior and reconcile ASR-530 traceability.

Test Plan

• Unit tests pass
• Integration tests pass if applicable
• Full completion suite required in CI before merge
• No coverage regression

Targeted runtime tests: 60 final-sink and opacity cases. Current evidence validators, 33 focused coverage tests, and four formal integration cases passed. Ruff and diff checks passed.

Ground Control Checks

• Repository policy checks required in CI before merge
• Pre-push Codex review completed; all findings fixed or dispositioned

Traceability

• IMPLEMENTS: Issue Commit a denied terminal outcome after final egress refusal #1358 ← implementations/python/packages/raes_runtime/participant_crossing_egress.py, ASR-530 ← docs/research/specification-coverage/bundles/raes-standardized-specification-coverage-issue-1358-v46.json, ASR-530 ← docs/research/formal-semantic-validation/bundles/retest-v46.json
• TESTS: Issue Commit a denied terminal outcome after final egress refusal #1358 ← implementations/python/tests/test_issue_1003_final_sink_flow_enforcement.py, ASR-530 ← implementations/python/tests/test_specification_coverage.py, ASR-530 ← implementations/python/tests/test_formal_semantic_validation.py

Checklist

• Code follows the project's coding standards
• Changelog: owned by Release Please (generated from the Conventional Commit PR title; no per-PR fragment)
• Architectural docs updated if stack, package structure, or key behaviors changed

Documentation

Updated: see diff.

[Brad-Edwards]

Ground Control delivery — this pull request delivers issue #1358; Phase E runs on merge.