feat(core): create a new device identity for each lease under lease.identity fresh

[V3RON]

Closes #75

What changed

New config lease.identity.ios / lease.identity.android, default reusable. Each device records the policy it was created under.

A fresh device serves one lease. When the lease ends, Simlock shuts it down, commits shutdown, then deletes it. It is never erased. mayBeGranted (domain.ts) is the one check that stops a spent device from being granted; the planner, warm pool, quarantine and startup all call it. A failed shutdown or delete emits device.purge-failed with strategy delete and quarantines the device; quarantine then retries the delete and never reclaims it. At startup, Simlock deletes spent devices left reclaiming or shutdown.

Spec deviation (agreed in session): the spec says no new transitions, but a failed delete happens in shutdown, so this adds shutdown → quarantined. A quarantined device counts as running capacity until it is deleted.

If a delete fails at startup, the device stays shutdown. It remains ungrantable, and the next start or the idle delete rule retries it. doctor --fix never moves a spent device from shutdown to ready, so its delete still finds it.

Completion conditions

• Two sequential fresh leases get different UDIDs: engine test.
• Release, expiry and device-lost termination each delete the device: one engine test each. A spent device is never granted: planner test (ready and shutdown scans).
• At most one lease per device, however it was created: the check reads the device record.
• A spent device counts against capacity until deleted: planner test.
• A failed delete leaves an ungrantable quarantine: engine, warm-pool and quarantine tests.
• Restart tests: reclaiming, shutdown-before-delete, grant then config change then release. Expiry after restart reuses the existing timer-restore path; there is no fresh-specific test for it.
• Reusable unchanged: existing suite plus a reclaim-and-reuse test.
• Both EVENTS.md cuts updated.
• CONFIGURATION.md documents the setting and the boot cost.

pnpm check passes. Each new path was broken on purpose and its tests failed.

Written by an agent.