fix(supervise): refuse in-doubt replacement dispatch

[drewstone]

Summary

• Refuse a keyed replacement when a durable start has no terminal receipt.
• Preserve the charged reservation and require recovery of that exact prior execution.
• Prove a SIGKILL/restart starts zero replacements and returns two explicit in-doubt refusals.

Verification

• pnpm test — 3,501 passed, 9 skipped
• pnpm run verify:package — pass
• pnpm run lint, pnpm run typecheck, pnpm run docs:check — pass
• Focused restart suite — 157 passed

[tangletools]

Independent restart-safety review: keyed in-doubt work refuses before factory construction or budget reservation; terminal down work remains retryable; completed work remains replayed. Focused local tests: 7/7. Required CI: 4/4 green. No blocking findings.