Preserve observer custody and avoid projection churn

[flip-engineer]

Long-running receive observers retain large heaps while the native session continues. Recovery now validates a live observer's process lifetime, database, session, retained output descriptors and session lock, then retires that observer through its held pidfd. Existing internal receive and recovery command forms are covered. Public receive custody is a follow-up correction.

Projection setup also compares existing trigger definitions before replacing them. Repeated setup preserves SQLite's schema version; missing or changed triggers are repaired within the existing transaction.

Validation on the homelab:

• Live internal handover retained the native PID, UUID, output inode and checkpoint. An unrelated PID was refused.
• Terminal handover retired an observer holding 75.6 GiB RSS and 7 GiB swap after its native process exited. Retained output, checkpoint and birth/status records were preserved.
• The exact-source SQLite harness passed unchanged setup, changed/missing trigger repair, rollback and concurrent installer checks. Repeated setup through the rebuilt executable preserved schema version and all 40 trigger definitions on a database copy.
• Deployed executable SHA-256: 9cc011e95da93526c433de7887863f3ef8d10df55043011125fba2ba52d602c5. Source fragments match this commit. Installation retained the previous executable as a verified rollback hardlink.

The operator authorized this narrow deployment with focused validation. The full Bend callback lifetime fix remains in #795. Tracks #696, #769 and #776.