Transfer staging leases and generation-scoped pool plan cleanup

[yinlin09]

Follow-up to the demand-staging stack. A transfer that settles — timeout, a failed copy or push, or completion — now publishes its outcome immediately but returns its staging blocks only after every accepted copy, push, and incoming payload has drained, so late work can never touch blocks already handed to another transfer. Pool reshard plans get the same lifecycle discipline as block plans.

Commit	Change
Operation leases	Every accepted copy, push, and payload holds a lease on its transfer's staging; the last release frees the blocks. A failed transfer retires its uuid so a late payload cannot land at identity-addressed blocks. Destruction admits no new handlers, counts handlers and workers, unblocks accepted sockets, stops the data transport, and waits for the last callback.
Pool plan generations	Pool reshard registration arms send/receive state first and publishes the plan last under the lifecycle lock, with a generation carried through settlement and timeout cleanup, so stale cleanup cannot drop a reused plan or its progress.

Both libraries build cleanly; the unit suites (including a new generation-scoped pool cleanup test) run in CI. Injection coverage that pauses a live copy or socket mid-transfer needs a live-transfer harness and is left as follow-up.