[ovasylenko]

A native callback can outlive its logical invocation and its MobileEngine. Admission and quarantine previously belonged to one engine, so a second engine/database could enter a newer claim for the same remote task while the predecessor was still physically running.

Reserve native task ownership process-wide by canonical backend API URL and task UUID before recording started dispatch. Keep that reservation in an enriched lease observer through physical callback and foreign destructor completion. Lease revocation still removes logical authority immediately; retaining physical ownership never renews or activates it. Contended claims are released unstarted, while unrelated tasks and different backends remain independent.

The change is additive to LeaseAuthority and preserves existing handler/SDK interfaces. It does not enable scoped remote execution or a new negotiated capability.

Validation:

• Reproduced actual callback overlap on clean main before the fix.
• Two integration regressions cover independent engines, logical cancellation, engine drop, blocked foreign destruction, unrelated task progress and recovery after physical return.
• Reservation tests cover canonical URL aliases, changed worker identities and epochs, clone lifetime, independent scopes and invalid/credential-bearing URLs.
• Core observer coverage proves retained owners survive revocation and drop with the last enriched observer.
• Isolated current-main validation: all 716 mobile tests, all 17 core lease tests, strict all-target workspace Clippy, actual WASM compilation and formatting passed.