[ovasylenko]

A newer claim cancels its predecessor synchronously, but a queued native callback could still enter the host while the executor was stalled because its unexpired lease observer did not inspect that supersession signal. The regression reproduces actual host entry on the parent code while the graceful-stop control passes.

Bind the authenticated claim's supersession token to the lease observer. Physical admission checks revocation directly, makes its first refusal permanent, and preserves physical resource ownership through callback cleanup. Graceful stop_worker behavior is unchanged: admitted tasks drain and settle.

Validation:

• Isolated parent reproduction: supersession failed at host entry; graceful draining passed.
• All 20 lease tests and all 718 mobile tests passed on the isolated fix.
• Strict all-target workspace Clippy, actual WASM compilation and formatting passed.
• The regression waits for physical admission to return while withholding executor progress, rather than assuming a fixed delay or blocking-pool queue order.
• Core coverage checks direct revocation, clone/physical-owner retention, pending supervision and preservation of the first terminal reason.

Rebased onto merged main after #378 with no source changes; the final tree exactly matches the locally validated tree.