fix(leasing): a handoff grant whose commit throws defers its waiter

[V3RON]

Closes #647

Status

Implement: done (596/596 leasing, 2348/2348 changed) Review: round 1 + fix check passed (spec, code, claims: F0) Hardware: n/a Gate: running
Next: gate result

• A waiter whose grant of the booted or provisioned device fails to store is deferred with one warn (step=grant) and granted on the next wake — the triage tests from bug/647-repro land in this PR and pass; deleting the catch turns both red on the grant-step warn assertion, and a catch without the #defer turns both red on queueDepth
• A failed handoff grant still releases the device claim and the capacity reservation — the releases stay in the finally; deleting them turns 40 leasing tests red, including the two triage tests

Assumptions

• Assumption: the warn message names the plan kind ("granting a provisioned device failed" / "granting a booted device failed") — matches the wording of the sibling grant-failure lines; no test or doc pins message text.

Review

Spec review: 0 blocking, 0 fixed, 0 notes. Code review: 0 blocking, 0 fixed, 0 notes. Claims review: 0 blocking, 0 fixed, 0 notes.
Rounds: 1. Tokens: n/a.

How the reviews were spawned: this session sits at subagent depth and the harness refused nested spawns, as on #643, #644, #646 and #650. Each reviewer ran as a fresh detached claude -p session — the body of .claude/agents/<reviewer>.md as its system prompt, its model from that file's frontmatter — reading only the inputs directory from .agents/scripts/review-inputs.sh and its own worktree of the reviewed commit, with no PR body, commit messages or another reviewer's output; each read .agents/briefs/calibration.md first. Round 1 reviewed 90d98d35; a format-hook rewrap of one test line forced a history rewrite, so a fix check (code and claims, lens: both) reviewed 90780cc9 and confirmed the delta formatting-only (F0 both). Nothing was reviewed by the agent that wrote the code.

Written by an agent.