fix(issue-6): fail-closed registry timeout and TUI turn handshake

- Introduce finalize_unfinished in multi-agent-mux-delegate-job for fail-closed atomic transitions
- Enforce CAS dispatch_token and attempt_id pinning across engine, CLI, and lifecycle scripts
- Integrate Herdr wait_for_agent_idle turn handshake to prevent prompt loss and race conditions
- Resolve bash 3.2 set -u empty array expansion compatibility in lib.sh
- Preserve Issue #5 R2 contract in CAS transition engine (engine.py, publish_event.py, service.py)
- Add comprehensive regression suites (test_issue6_fail_closed.py, test_issue6_turn_handshake.py)
- Bump lockstep framework and skills to v4.4.1 across lib.sh, eager.py, VERSIONS.md, 8 SKILL.md
- Synchronize documentation (IMPROVEMENTS.md, MESSAGING.md, state-transitions.md, task.md, phase5-e2e.md)
- Unanimous PASS achieved across 4 reviewer team leaders (Claude, Codex, OpenCode, Grok)

Closes #6

tests/fixtures/issue_5/phase1/help-publish_event.txt

@@ -5,7 +5,8 @@ usage: publish_event.py [-h] (--job JOB | --pick-pending)
                         [--registry-dir REGISTRY_DIR] [--attempts ATTEMPTS]
                         [--finalize-report PATH]
                         [--side-effect KIND=REFERENCE]
-                        [--attempt-id ATTEMPT_ID] [-v]
+                        [--attempt-id ATTEMPT_ID]
+                        [--expect-dispatch-token EXPECT_DISPATCH_TOKEN] [-v]
 
 Publish a Job event to MQTT
 
@@ -30,4 +31,6 @@ optional arguments:
   --attempt-id ATTEMPT_ID
                         attempt this finalization belongs to (default: the
                         job's current iteration)
+  --expect-dispatch-token EXPECT_DISPATCH_TOKEN
+                        expected dispatch token for CAS verification
   -v, --verbose