Recover ACA setup timeout admissions

[Laveesh Rohra (larohra)]

Summary

• return durable session/run management handles when ACA setup times out after reservation, while preserving a context-free timeout before reservation and a typed uncertain-admission outcome
• make status, result, events, and cancellation Table-readable throughout provisioning, with linked conflict responses and public provisioning/executing/settling/terminal phases
• fence pre-launch cancellation against journal launch for both new and existing sessions, and safely reconcile canceled or missing-run setup operations without duplicate provider work
• amend FRD 0008 plus architecture, operator, client, deterministic race, Azurite, and one-shot deployed-host guidance

Validation

• python -m ruff check src tests
• python -m mypy src (97 source files)
• python -m pytest tests -q (1818 passed, 59 skipped, 84 deselected)
• final independent GPT-5.6 Terra/max merge-blocker review: no significant issues

The opt-in live ACA and Azurite scenarios were not executed locally. The default gate skips/deselects those environments; this change adds deterministic coverage for their branches and a deployed one-shot test that never replays the original POST.

Integration

Based on feature/aca-sandboxes at 2ee15e94403fb8b15d49a2fe623289a91b615eeb. This PR intentionally targets that integration branch and is separate from PR #160.