fix(proxy): hold fenced hard turns through cooldown

[kevinsslin]

Closes #1737.

Summary

• keep an explicitly enabled hard turn-state request pending through an active HTTP bridge retry-circuit cooldown
• require a live durable session and owner epoch, zero response events, and no response id before waiting
• send nothing upstream during the wait; after cooldown, preserve the existing durable operation-ledger arbitration and one-shot recovery cap
• fail closed when durable proof is unavailable or the request budget expires
• preserve the default fail_closed behavior
• add low-cardinality wait telemetry and strict OpenSpec coverage

Why

Production telemetry showed two eventless upstream failures opening a 60-second retry circuit. Codex Desktop retried in milliseconds despite the HTTP/SSE retry hints, exhausting its retry budget against startup 503 responses. Turn-state-only hard continuity was rejected before the durable operation ledger could arbitrate bounded recovery.

The recommended deployment mode for this incident class is server_anchored_replay_once; this PR does not make recovery default-on or add unbounded retries.

Validation

• 5871 passed, 70 skipped — complete unit suite
• 553 passed — HTTP bridge unit file
• 129 passed — HTTP bridge integration suite
• focused production-shape, no-durable-fence, and expired-budget regressions pass
• Ruff check and format pass
• ty check passes
• proxy architecture check passes
• strict OpenSpec validation passes for this change
• git diff --check passes

The full repository OpenSpec sweep contains unrelated pre-existing incomplete changes; this change validates independently under --strict.

[kevinsslin]

Superseded by #1739. This draft was opened from the fork-main integration branch and unintentionally included five unrelated reliability commits. #1739 is the clean one-commit, seven-file patch based directly on upstream/main.