Validate Jepsen conflict deaths against independent claim evidence

[jeregrine]

Problem

The Jepsen driver trusted every {:group_registry_conflict, key, winner_meta} exit. It removed the owner's intent and credited conflict coverage without checking whether that process actually lost a registry conflict. Killing a revision-99 owner with a nonexistent key and an invented revision -100 winner could therefore leave an apparently valid empty terminal state.

Fix

Retain conflict deaths as oracle obligations. An independent, restart-persistent harness journal records registration invocations before calling Group, their outcomes, and intent removal. The Clojure checker reconstructs the victim's possible registrations and requires the reported winner to have a strictly higher {revision, token} rank and matching historical claim evidence for the same cluster and key. Only independently justified deaths contribute conflict coverage; invalid deaths fail the history even after Group has cleaned up every row.

Registration calls interrupted before their reply remain possible claims, while definitive :taken results exclude attempts. Historical evidence remains available after the winning owner unregisters, dies, or the BEAM restarts. Permanently retired nodes' journals are archived through the stopped-container collector and replayed alongside every snapshot, preserving both winning claims and invalid deaths without treating retired owners as live.

Before each new history, DB setup resets the running recorder's disk and memory together. Mid-history restarts preserve evidence, while repeated histories cannot inherit earlier conflict coverage. Qualification consumes EDN emitted by the actual Owner/Driver harness and the archive decoder.

Supporting information

Stacked on #23 (fix-jepsen-retired-evidence) to extend its lifecycle collector rather than duplicate it. This changes only the Jepsen harness and oracle, not Group's conflict semantics.

The oracle proves independently witnessed possible winners, not the exact instant a replica learned each claim. Local journal order rejects winners first attempted after a death; it does not assume synchronized cross-node clocks or that a remote unregister was already delivered.

Conflict archives use small append-only workload records, a 64 MiB collection bound, and ten-second command deadlines. Missing, truncated, unreadable, or malformed archives fail qualification. Checker qualification and retired-journal decoding require Elixir/Mix and the repository dependencies on the controller host.