L01-03: fence scheduled and worker results

[mberrys]

Closes #17.

Change

• Bind scheduled document jobs to the revision fence present at submission. Closing and reopening the same revision invalidates old work, and cancellation or revision changes are checked atomically when the scheduler records success.
• Admit document, page-surface, preflight, Action List, and PDF comparison results only after the matching terminal job and request identities are current. Render admission compares the returned full key and generation token with the registered request.
• Publish preflight audit runs after terminal admission so cancelled or superseded workers cannot record an accepted run.

Proof

• Source SHA: d297f8e5680ef71a7ba6c9c5e04a1040a337b258 (base dc9ea93a1379ff4233f86059cd297b29c5962fda).
• Windows MSVC Release: ctest --test-dir build -C Release --output-on-failure -R "^(UnitTestsJobScheduler|UnitTestsRevisionStress|UnitTestsRepairDiff|UnitTestsPageSurface|UnitTestsDocumentFacade|UnitTestsPreflightInteraction|UnitTestsViewportCommands|UnitTestsEditorHost)$" — 8/8 passed.
• Fault fixtures: in-memory document-1/revision-1 scheduler jobs, synthetic doc-1 page surfaces, and the DocumentFacade fake loader. They cover timeout, retry, cancel, reopen, out-of-order completion, mismatched render identity, and worker success followed by scheduler failure; no external fixture artifact was used.
• scripts/agent/check-architecture.py --base dc9ea93a1379ff4233f86059cd297b29c5962fda --head-branch codex/issue-17-fence-scheduled-results — passed. scripts/agent/check-change.py --base dc9ea93a1379ff4233f86059cd297b29c5962fda --build-dir build ran the mapped Release lane: all builds and 74/74 tests passed. Its overall result is not a pass. The format check exposed mixed line endings in the cancellation fixture; these were normalized without a source-content change, and a direct clang-format --dry-run --Werror rerun passed. The Visual Studio build lacked a compile database, leaving the gate's clang-tidy lane incomplete. A Ninja compilation database allowed a separate clang-tidy run on pdfjobscheduler.cpp to finish with exit 0 and warnings; a full gate rerun was stopped after clang-tidy spent over twelve minutes on editorhost.cpp without reaching the other changed files.
• GitHub PR checks on this head: all completed checks passed, including agent-fast / build, fuzz, CodeQL, Semgrep, policy, architecture, source integrity, package scripts, and language analyses. The windows and linux jobs were skipped by workflow rules.

Remaining risk

The timer-based admission handoff relies on the scheduler reaching a terminal snapshot after a worker returns. Its failure path rejects absent or unsuccessful snapshots. Independent release qualification and other platforms remain governed by the existing proof lanes.

Anti-slop review

Reviewed the touched diff for redundant checks, comments, and wrappers. Kept only boundary checks that bind terminal status and request identity; removed an outdated revision-fence comment and a duplicate include.