fix(telegram): fence topics with shared durable authority

[twoimo]

Summary

This PR brings the Telegram topic-registry shared durable-authority slice onto the current dev tip. It keeps topic settlement, replacement, retained cleanup, and generation fencing bound to the same exact authority across daemon restart and retry paths.

The native exact-replacement dependency is already available on dev via merged PR #3596. This branch is based on current dev and contains only the Telegram authority slice plus its deterministic generation-manifest refresh.

Verification

• bun scripts/telegram-daemon-generation-guard.ts --validate-current-tree
• bun --cwd=packages/natives run build
• bun --cwd=packages/coding-agent run check:types
• bun test packages/coding-agent/test/notifications-telegram-daemon.test.ts packages/coding-agent/test/notifications-telegram-daemon-cas.test.ts packages/coding-agent/test/notifications-topic-registry.test.ts packages/coding-agent/test/notifications-topic-settle-fence-epoch.test.ts packages/coding-agent/test/notifications-telegram-daemon-2960-redteam.test.ts packages/coding-agent/test/daemon-control.test.ts packages/coding-agent/test/file-lock-gc-toctou.test.ts (771 passed)
• Focused Biome check on the changed Telegram sources/tests and manifest

The two Windows-only cases in notifications-telegram-daemon-2960.test.ts were not counted in the POSIX run because this environment is not Windows; they require the upstream Windows CI lane.

Thank you for reviewing this focused follow-up.

[Yeachan-Heo]

Signed: Yeachan-Heo / fresh-session batch review lane

REQUEST_CHANGES — external candidate admission is denied; no mutation lane or branch repair is authorized.

Exact-head evidence:

• Head: 061e79b, based on current dev 58c1b16.
• Contributor gate: author @twoimo, author_association=CONTRIBUTOR, non-draft, 2 commits, 21 files, mergeable_state=unstable.
• The PR has no prior-blocker map covering the active #3622 notification surface, the current #3596 dependency, or the exact failing test obligations.

Exact CI failures (run 30687620829):

1. notifications-telegram-daemon-cas.test.ts — Windows CAS successor test fails at line 333 because the test expected a substituted destination inode but observed the original inode; 9 pass / 1 fail.
2. notifications-telegram-daemon-2960.test.ts — both Windows write-through tests receive ENOENT for C:\topics.json instead of the required TopicRegistryDurabilityUnavailableError; 6 pass / 2 fail.

Independent reproduction and baseline comparison:

• An isolated exact-head snapshot with native dependencies built reproduced the 2960 fixture failures locally.
• Current dev 58c1b16 has the existing 2960 test passing (4/4); the new CAS test is absent from current dev. These failures are therefore introduced by this candidate test/fixture surface, not inherited baseline failures.
• The PR is not a harmless isolated rebase: active #3622 head 1afc578 is 10 commits ahead of current dev, and #3695 overlaps 11 files with that 56-file notifications/settings surface, including telegram-daemon.ts, telegram-daemon-cli.ts, telegram-daemon-contract.ts, daemon-control.test.ts, notifications-config.test.ts, notifications-telegram-daemon.test.ts, docs, changelog, and the generation manifest.

The branch must not be repaired in this lane. Re-submit only with corrected exact-head CI, a complete prior-blocker/disposition map, and explicit scope/ownership proof against #3622 and #3596.

No source mutation was performed by this review.

[twoimo]

Thanks for the exact-head review. I confirm #3695 is closed at 061e79b on dev 58c1b16, with the two reported failures in notifications-telegram-daemon-cas.test.ts and notifications-telegram-daemon-2960.test.ts. I will not repair or push this closed branch in the current lane; the requested re-submission should include corrected exact-head CI, the prior-blocker/disposition map, and explicit scope/ownership proof against #3622 and #3596. No merge was performed.