Runtime: keep retired capability state bounded and durable #443

Runtime owns bounded capability retirement state and durable updates for processes that share a data directory. Retired authority stays refused during recovery, while current valid grants remain usable.

Done means:

• Define and test the retention and retirement contract, including existing stored state.
• Keep authority decisions consistent through concurrent writers, restart and interrupted persistence.
• Prove bounded retained state over repeated lifecycle operations and preserve unrelated current grants.
• Keep detailed source evidence and failure cases in the private review. Record exact-candidate review and installed acceptance before closure.

Coordinate capability-store ownership with #203. Session stop remains in #177; Browser operator retirement remains in #438.

Acceptance record:

• Candidate: pending.
• Exercised checks: source and ownership review only.
• Review links: pending.
• Installed release evidence: pending.
• Remaining gate: agreed retention design, implementation, regression proof and applicable independent reviews.
• Next owner: capability-store owner, to be agreed.