Review 2: harden Yieldstar deployment scoping and coordination visibility

[djgrant]

Second independent release review of the Yieldstar 0.5.0 integration (follows PR #38). Semantics were verified against the installed Yieldstar 0.5.0 source rather than assumed.

Fixes

• Cross-deployment orphan deletion.YieldstarStateBackend built store IDs as deploymentId:resourceId and filtered values()/clear() by the raw deploymentId: prefix, so deployment app matched stores of deployment app:blue and would list and delete them as orphans. The deployment segment is now URI-encoded so the delimiter cannot occur inside it. Regression test covers listing and clear isolation.
• Silent durable wait behind a stale coordination holder. If an operation crashed while holding the deployment coordination store and a new execution ID was started, store.take parked the new execution forever with no output. Both deploy and destroy now emit a durable reconciler.coordination.waiting warning naming the holding execution ID before suspending. Regression test covers the event.
• CLI destroy error handling.notation destroy now matches deploy: credentials guidance and exit code 1 instead of an unhandled rejection.

Verified sound against Yieldstar 0.5.0 source

• Coordination try/finally release: suspended executions are abandoned without generator.return(), so finally does not run and the holder is correctly retained across durable waits; terminal errors thrown back into the workflow do run the durable release.
• All step keys are explicit and unique per execution; step.store keys derive from store name and ID, so loop usage is safe under the driver's duplicate-key check.
• updateFrom/deleteFrom/take are recorded in the applied-steps ledger in the same transaction as the state change, closing the store-commit/heap-write crash gap; whole-store version plus UUIDv7 instanceId CAS matches the release intent.
• Provider retry versus terminal distinction maps retryLaterOnError to RetryableError with correct driver maxAttempts semantics; crash-resume, destroy ordering, and orphan handling are exercised by the existing suite.
• No compatibility fallbacks to the removed synchronous mutation/lease/refresh paths remain.

Checks

Build, typecheck, and the full test suite pass (77 passed, 4 skipped).

[djgrant]

Closing this review-only PR. Its fixes will be carried into the simplify implementation PR stacked on #38.