fix(issue-6): fail-closed registry timeout and TUI turn handshake

- Introduce finalize_unfinished in multi-agent-mux-delegate-job for fail-closed atomic transitions
- Enforce CAS dispatch_token and attempt_id pinning across engine, CLI, and lifecycle scripts
- Integrate Herdr wait_for_agent_idle turn handshake to prevent prompt loss and race conditions
- Resolve bash 3.2 set -u empty array expansion compatibility in lib.sh
- Preserve Issue #5 R2 contract in CAS transition engine (engine.py, publish_event.py, service.py)
- Add comprehensive regression suites (test_issue6_fail_closed.py, test_issue6_turn_handshake.py)
- Bump lockstep framework and skills to v4.4.1 across lib.sh, eager.py, VERSIONS.md, 8 SKILL.md
- Synchronize documentation (IMPROVEMENTS.md, MESSAGING.md, state-transitions.md, task.md, phase5-e2e.md)
- Unanimous PASS achieved across 4 reviewer team leaders (Claude, Codex, OpenCode, Grok)

Closes #6

tests/fixtures/issue_5/phase1/help-job_subscriber.txt

@@ -1,5 +1,7 @@
 usage: job_subscriber.py [-h] (--job JOB | --wait-any) [--timeout TIMEOUT]
                          [--idle-timeout IDLE_TIMEOUT] [--expect-retention]
+                         [--expect-dispatch-token EXPECT_DISPATCH_TOKEN]
+                         [--attempt-id ATTEMPT_ID]
                          [--registry-dir REGISTRY_DIR] [-v]
 
 Subscribe to Job events on MQTT
@@ -14,5 +16,9 @@ optional arguments:
                         max seconds with no new event (default:
                         job.idle_timeout_sec or 120)
   --expect-retention    warn if no retained terminal event arrives promptly
+  --expect-dispatch-token EXPECT_DISPATCH_TOKEN
+                        expected dispatch token for CAS verification
+  --attempt-id ATTEMPT_ID
+                        minimum attempt id to accept events for
   --registry-dir REGISTRY_DIR
   -v, --verbose

tests/fixtures/issue_5/phase1/help-publish_event.txt

@@ -5,7 +5,8 @@ usage: publish_event.py [-h] (--job JOB | --pick-pending)
                         [--registry-dir REGISTRY_DIR] [--attempts ATTEMPTS]
                         [--finalize-report PATH]
                         [--side-effect KIND=REFERENCE]
-                        [--attempt-id ATTEMPT_ID] [-v]
+                        [--attempt-id ATTEMPT_ID]
+                        [--expect-dispatch-token EXPECT_DISPATCH_TOKEN] [-v]
 
 Publish a Job event to MQTT
 
@@ -30,4 +31,6 @@ optional arguments:
   --attempt-id ATTEMPT_ID
                         attempt this finalization belongs to (default: the
                         job's current iteration)
+  --expect-dispatch-token EXPECT_DISPATCH_TOKEN
+                        expected dispatch token for CAS verification
   -v, --verbose

tests/fixtures/issue_5/phase1/help-registry.txt

@@ -1,16 +1,17 @@
 usage: registry.py [-h] [--registry-dir REGISTRY_DIR]
-                   {register,list,get,status,update,get-feedback,pick,logs}
+                   {register,list,get,status,update,close,get-feedback,pick,logs}
                    ...
 
 multi-agent-mux-delegate-job registry CLI
 
 positional arguments:
-  {register,list,get,status,update,get-feedback,pick,logs}
+  {register,list,get,status,update,close,get-feedback,pick,logs}
     register            create a pending job; prints the job id
     list                list jobs (optionally by status)
     get                 print one job record as JSON
     status              set a job status
     update              update a job record
+    close               close a job with deadline_timeout or cancelled
     get-feedback        get the last feedback detail (completed/error) for a
                         job
     pick                claim a pending job for a session; prints id