fix(acp): fence terminal message publication

[youlikemodernart]

Summary

Managed ACP turns can finish or be cancelled while a descendant buzz command is still preparing a channel reply. Stopping the model turn alone does not prevent that descendant from submitting a late message.

This change adds a cross-process publication fence around managed ACP turns:

• opens a generation-scoped fence for each managed turn;
• captures the active generation at the start of messages send and messages send-diff;
• holds a shared lease across the final relay submission;
• terminalizes the turn before cancellation, completion, retry, rotation, respawn, or pool return;
• kills and reaps the managed process tree when a publication lease does not drain within the bounded close window;
• enforces a co-versioned buzz CLI capability in managed ACP and Sprig packages;
• preserves current channel-context and session-title behavior;
• accepts the stock UI owner-control form, such as !cancel @Agent Name, while retaining exact owner, event-kind, and target-agent tag checks.

Unix teardown uses the ACP process group. Windows uses safe taskkill /T /F /PID; a failed tree kill cannot report successful settlement while a descendant still holds the publication lease.

Related issue

Fixes #3587

Testing

No UI changed, so screenshots are not applicable.

Passed locally on macOS:

• cargo fmt --all -- --check;
• Clippy for buzz-acp and buzz-cli, all targets, with warnings denied;
• 643 buzz-acp unit tests;
• 9 ACP lifecycle tests;
• 258 buzz-cli tests;
• 7 buzz-publication-fence tests;
• focused true-grandchild lease-holder teardown regression;
• focused terminal messages send-diff rejection regression;
• Sprig package capability check;
• Tauri sidecar-set capability check;
• git diff --check.

Manual product validation also passed:

• a normal managed generation produced one reply, no duplicate, and zero managed runtime after stop;
• a delayed generation received a UI-authored owner cancel, produced no reply through the full delayed-publication observation window, and returned to zero managed runtime.

Full just ci remains blocked by one deterministic current-main mobile widget failure:

ChannelDetailPage keeps follow mode off while a tall newest message stays visible

The exact focused mobile test fails repeatedly, and this PR has no mobile/ diff. The unrelated test was not skipped or weakened.

Native Windows execution was not available locally. The Windows process-tree path is compile-gated and should run in CI.