feat: add durable ManagedSession inbound events

[wms2537]

Closes #52

Outcome

Implements durable, authenticated, idempotent ManagedSession inbound events with canonical per-session receipt ordering and deterministic dispatch classification.

Acceptance coverage

• binds source identity to the authenticated principal
• serializes tenant/source/event deduplication and returns replay or 409 event_conflict
• assigns gap-free monotonic receivedSequence values
• validates current-run wait correlation and payload schema
• queues future-run events without overtaking an older deferred receipt
• enforces bounded payload, snapshot-reference, cursor, and page limits
• prevents legacy signal delivery from bypassing ManagedSession event receipts
• preserves immutable tenant lineage and terminalizes pending events on cancellation
• covers replay, conflict, concurrency, crash/retry ordering, fairness, cursor, schema, and cancellation behavior through HTTP

Verification

• exact commit: 1044ab3e949d6f07349e845b6855cd91fc2d1184
• npm run release:gate: PASS
• evidence: release-evidence/2026-07-22T08-14-43-789Z
• focused ManagedSession event tests: 7/7 PASS
• independent specification review: PASS on the exact commit (4 files / 34 tests)
• independent standards review: PASS on the exact commit (typecheck and 7/7 focused tests)