Lifecycle: reload/teardown safety for instances (bounded drains, interrupt-safe claims, reusable-reload wedge fix)

Context

Part of the fork hardening series proposed in #48638 (branch session-diff-events). Tracker: #49565.

Problem

Instance lifecycle hazards: interrupt-unsafe claims, unbounded teardown waits, reload-ordering violations, stale teardown tracking, and a reusable-reload wedge where a never-settling disposer left reload/provide/load dead (total directory wedge). Also tombstone/lease correctness for directory reuse.

Change set (commit list, incl. instance halves of mixed commits)

• 887b912207 wave F tombstone/lease
• b8bf11bd9b wave D tombstone/lease
• c637878773 wave J-B instance-store
• 13f3368fa8 wave M-B instance-store
• (instance halves of 1ee7d234ec / 88777b8591 to be split for clean stacks)

Validation

• Base total-wedge probe (reload/provide/load all time-out) -> head fully live (provide ~1 ms, load ~0 ms); ordering guarantees preserved; instance suite 27/0.

Linked: PR #48638 · tracker #49565 · sibling tracking issues listed in a follow-up comment.

Start with linked PR #48638 and tracker #49565, then review the listed instance-store and tombstone/lease commits. Run the base total-wedge probe and instance suite described in Validation; done means reload, provide, and load remain live, ordering guarantees hold, and the instance suite reports 27/0.