Drop ClearFinal, the Final mirror marker, and MarkContainerStopping's volume field#1648

Summary

This is PR 2 of 7 in the Volume RPC cut. It deletes old-flow pieces early, so PR 7 has less to remove. Warm Move carried three pieces nothing in production reaches. Only tests ever built a Final marker on a mirror, so ClearFinal always met an Idle mirror and changed nothing. Only a unit test called withdraw_volume, the one caller that set volume on MarkContainerStopping. This PR removes all three before the new volume verb lands. A Release or a move undo now sends one verb fewer, and Cloud no longer runs step 14.

AcceptHandOff already takes an Idle mirror. BeginRound never refused on the marker; it only reset Final to Idle. A run without step 14 reaches the same copies.

Changes

• ClearFinal verb. Removed:
  • the catalog entry, CLEAR_FINAL_CAPABILITY (ployz.volume.clear-final.v1) and its op
  • the SDK body and the clear_final command in index.d.ts
  • the daemon handler and the /Volume.ClearFinal plugin route
  • switch_target clear_final and its kill_after_record("ClearFinal") fault hook
  • the clear_final stub in the three fake test servers
• Final marker. MirrorMarker drops Final { guid } and its final:<guid> form. BeginRound loses its Final-to-Idle reset. AcceptHandOff now matches Idle, HandedIn with the same guid, and refuses the rest. The generated MirrorMarker type drops "final".
• MarkContainerStopping. MarkContainerStoppingRequest is now { container_id }. The daemon marks the Container stopping and no longer forwards to the volume plugin. The /Volume.MarkContainerStopping route and switch_source mark_stopping are gone. MarkContainerStopping itself and the Withdraw verb stay.
• withdraw_volume. Removed from ingress.rs along with its unit test.
• Cloud (dashboard/src/modules/volume-run).
  • Release and the move undo no longer send 14-clear-final. The undo still fails at step id 14-undone.
  • undoClearsTarget is gone, so an undo's lease counts only the source's record.
  • Release counts only the source when it thaws, and nothing otherwise.
  • The planner drops the final role and the isFinal fallback. A Release's mirror is now only the copy that holds the frozen snapshot. It is kept so the approval still names the handed copy a thaw discards.
• Tests. Final-marker fixtures became Idle or HandedIn. The ClearFinal tests and their verify-faults entries are gone. Withdraw keeps its replay test without MarkContainerStopping. plan.test.ts gains participant cases for a thawing Release and an undo.

Verification

All commands ran in core/ or dashboard/ and exited 0. The builder ran them before the stack was rebased onto bea6ccf16.

• cargo fmt --check
• rtk proxy cargo clippy -p ployz-core -p ployzd -p ployz --all-targets -- -D warnings
• rtk proxy cargo clippy -p ployzd --all-targets --features verify-faults -- -D warnings
• rtk proxy cargo nextest run -p ployz-core -p ployzd -p ployz -E 'test(switch_target) | test(mirror) | test(local) | test(ingress) | test(volume_switch) | test(capabilit) | test(lease) | test(departure) | test(switch_source) | test(sdk_payloads) | test(marking)' gave 281 passed.
• rtk proxy cargo nextest run -p ployz-core -p ployz -E 'binary(capabilities) | binary(sdk_payloads)' gave 5 passed. The generated payloads.d.ts matches.
• rtk proxy cargo nextest run -p ployzd --features verify-faults -E 'test(switch_target) | test(switch_source) | test(mirror) | test(verify_faults) | test(faults)' gave 65 passed.
• rtk proxy pnpm typecheck and rtk proxy pnpm lint passed.
• rtk proxy pnpm vitest run src/modules/volume-run gave 182 passed. That includes volume-run.postgres.test.ts against its Docker Postgres, after building the native SDK with core/scripts/build-cloud-sdk.sh.

Merge Danger

• ClearFinal, its ployz.volume.clear-final.v1 capability, and MarkContainerStopping's volume field never shipped in a release. v0.2.4 has none of them. A dev build that sends clear_final gets an unknown-verb error.
• A dev Cloud that still sends volume on MarkContainerStopping is not refused. The request has no deny_unknown_fields, so the daemon ignores the field and only marks the Container stopping. The /Volume.MarkContainerStopping plugin route is gone.
• MirrorMarker no longer parses final:<guid>. A pool that still holds that ployz:mirror value fails to read it. Only tests ever wrote one.
• Cloud drops step 14 (14-clear-final) from Release and from the move undo. An undo's lease no longer counts a slot target's record.
• The whole chain lands together, so no compat shims.