fact: add tenant admission coordination foundation

[justinjoy]

Summary

• add a handle-owned tenant admission manager with writer-preferring read/write leases
• enforce OPEN -> CLOSING -> CLOSED runtime lifecycle with cancellation, lease lifetime, and shutdown propagation
• add a canonical (tenant_id, graph_id) ordered graph writer-lock set with rollback, reverse release, and recursion guard
• document the service-auth -> tenant -> graph lock ordering while keeping durable lifecycle behavior unchanged

Scope

This is the self-contained #549 Unit 1 foundation. It does not complete #549: operation-entry integration, tenant seal/drain/evict, unseal publication, and lifecycle surfaces remain later units. It does not duplicate or modify #548/#983 graph-seal HTTP/unseal work.

Validation

• ninja -C build-549 -j2
• meson test -C build-549 fact-tenant-admission fact-runtime fact-replay fact-graph-seal daemon-http-facts --print-errorlogs (5 passed, 0 failed)
• ninja -C build-default -j2
• meson test -C build-default --suite wyrelog --print-errorlogs (220 passed, 0 failed, 2 skipped)
• ./tools/check-format.sh --staged
• git diff --cached --check

Related to #549