fix(electron): own fuse cleanup through adapters and shutdown

Adapt the prepared descriptor lifecycle repair from xu91102/rea dbb7db16. Bind exact file cleanup leases, retain typed physical failures and cancellation reasons, and join CLI/MCP finalization and active preflight. Share canonical Evidence construction and retain completed reports across reader handoff cancellation.

Scope active capture admission through shutdown and gate launch after close. Preserve successful descriptor peers and retry only unresolved owners. Separate process/transport retry ownership remains tracked in #4805.

Validation: 168 focused checks passed, one Windows-only skip; built CLI and actual stdio MCP controlled descriptor recovery; build, static and docs checks. No natural OS fault or real Electron launch/teardown claim. Ordinary full replies and Evidence IDs remain byte identical across 30 small CLI tasks.

Fixes #4658

Co-authored-by: hhang <169027046+xu91102@users.noreply.github.com>

src/application/javascript/ElectronActiveObservationPort.ts

@@ -16,6 +16,8 @@ export type CanonicalElectronActiveObservationInput =
 /** Provider-neutral boundary for owned Electron runtime experiments. */
 export interface ElectronActiveObservationPort {
   identity(): ProviderIdentity;
+  /** Join admitted captures and retry retained preflight cleanup. */
+  close?(): Promise<void>;
   capture(
     input: CanonicalElectronActiveObservationInput,
     options?: ExecutionOptions,