fix(ding): require positive harness receipts

[myobie]

Summary

• preserve the production combined bracketed-paste + 0.5 second delay + Return transaction; record ownership before it and separate transport success from harness acceptance
• add a harness-neutral ReceiptState router; Codex and Claude adapters alone own renderer-specific Accepted, RetainedSafe, RetainedBlocked, and Unproven classification
• make Delivered require the expected DING text in an adapter-recognized submitted-prompt or queued-message pattern while the lowest live composer is empty or an accepted idle placeholder
• retain FIFO ownership on transport/Return success without a receipt, command or peek errors, retained text, generic screen changes, disappearance alone, changed drafts, and ambiguous pixels
• keep staged retry inspection-only: complete accepted work without input, allow one bare Return only after two adjacent RetainedSafe observations, and never re-paste
• align DING-R01–R03, DING-R10, the production flow, per-harness VRS, source docs, tests, and invariant proof with that shipped state machine

Verification at 07dd0e0cc4216e38a5a0b9186e630c75d14e58e8

• cargo test --lib ding::tests -- --test-threads=1: PASS (27/27)
• cargo test --test invariants -- --test-threads=1: PASS (1/1)
• cargo test --workspace --all-targets -- --test-threads=1: PASS
• cargo clippy --workspace --all-targets -- -D warnings: PASS
• rustfmt --edition 2024 --check src/ding/mod.rs src/ding/harness/mod.rs: PASS
• cargo doc --workspace --no-deps: PASS with five pre-existing unrelated warnings
• git diff --check: PASS
• Hosted Nix: PASS — run 30555918103 / job 90916206635

No live catalog, supervisor, service, inbox, or PTY state was mutated. This remains a draft pending exact semantic re-review.

Closes #92.