feat(worker): emit App Update cleanup terminal receipt

[bytemain]

Summary

• add an authenticated, publisher-only Android App Update cleanup-terminal producer
• derive inactive from an exact current-generation Hands resolver readback for the target installation instead of trusting an executor boolean
• atomically freeze one durable operation, immutable receipt, exact Stamp payload, subscriber set, signing-key generations, signing-secret snapshots, and delivery rows
• make exact response-loss replay return the same receipt without reselecting subscribers or changing payload/signing bytes
• reject cross-run, stale-attempt, different-bundle, stale-revision, ambiguous-asset, out-of-scope target, and subscriber drift

Safety boundary

Source only. This PR does not create a B fixture, mutate a release/scope, deploy, or run a live terminal action.

Validation

• focused App Update producer/migration/reaper: 16/16
• Worker: 261/261
• full workspace tests: Worker 261, CLI 27, Node 13, Admin 25, Electron 3, Container 3
• full workspace build
• Worker and proxy-shim TypeScript builds
• all 55 migrations (0001..0054) sequential SQLite apply
• Wrangler deploy dry-run
• git diff --check
• Worker lint is blocked before source linting by the repository's existing ESLint 9 missing eslint.config.*