feat(cli): add verifiable session lifecycle

[mmilanez]

Summary

Adds the OpenAI Build Week executable session lifecycle to the public CLI:

• lead-protocol session open registers the pair, transitions handoff state, and writes a SHA-256 boot receipt;
• lead-protocol checkpoint creates a UTC checkpoint owned by the active session and updates only its pointer;
• lead-protocol session close validates state, requires an explicit JOURNAL answer, writes the terminal handoff, removes only the owned row, and emits a close receipt.

Build Week provenance

Lead Protocol predates the July 13, 2026 submission-period start. This PR contains the post-July-13 extension being submitted: executable lifecycle commands, deterministic receipts, optimistic peer-safe mutation, guarded close, lifecycle tests, and install-from-tarball smoke coverage.

Public PRs #22, #26, and #27 and their commits predate the submission period and are intentionally not included. They will need rebase and version renumbering after this release.

User impact

Agents and developers can now prove which protocol state was loaded, preserve unrelated concurrent sessions, create an attributable checkpoint, and close without reporting success after failed validation or checklist confirmation.

Supported platforms: Windows, macOS, and Linux with Node.js 18+.

Validation

• npm run typecheck
• npm test — 5/5 lifecycle tests passed
• npm run test:pack — built @leadsolutions/lead-protocol@2.1.0, installed the exact tarball in a clean temporary project, and completed init -> validate -> status -> session open -> checkpoint -> session close
• template state validator passed
• sync leakage sweep passed with no private paths or artifacts

Closes #28