Cover crash-window leak paths in lease/reservation stores

[bpapillon]

SCH-6645

Tests only. Pins the bounded-leak contract for the two documented crash windows in the credit lease path:

• Debit-then-add gap: a crash between leaseStore.tryReserve and reservationStore.add leaks at most the reserved amount, is invisible to the sweeper, is reclaimed at lease expiry (expiry guard + successor lease), and a retried check never double-refunds. Also drives the real checkWithLease with an add frozen mid-flight to pin the debit-before-record ordering.
• Consume-then-refund gap: a crash between claiming a reservation and refunding the unspent slice loses at most that slice; the claim is durable, so a retried settle or sweep never re-claims or double-refunds, and the slice is reclaimed at lease expiry. Includes a Redis-specific crash-right-after-claim case where the sweeper reconciles the orphaned indexes without refunding.

Both the in-memory and Redis (fake-redis) backends are covered. The contract held everywhere; no production changes.