Factory: recover abandoned legacy metric transition claims

## Problem

The exclusive hard-link claim used by the #306 legacy-draft migration prevents concurrent terminal overwrites, but a process or host crash after claim creation can leave the transition claim behind. Later migrations then fail closed until an operator removes it.

This was identified during exact-head review of #307.

## Scope

- Add bounded, auditable ownership/liveness metadata or another crash-recoverable serialization mechanism.
- Preserve exactly-once terminal transition semantics under concurrent closeouts.
- Avoid automatic deletion when an active owner may still exist.
- Add crash-recovery and concurrency regression tests.

## Acceptance criteria

- A demonstrably abandoned claim can be recovered safely.
- A live transition cannot be stolen.
- Concurrent writers still produce one immutable terminal receipt.
- Recovery behavior and operator diagnostics are documented.

Related to #306 and follow-up to #307.

Start by tracing the #306 legacy-draft migration and the exact-head review context from #307 to locate claim creation, terminal closeout, and existing tests; no file or test path is named in the issue. Define recovery and diagnostic behavior against the acceptance criteria, then add crash-recovery and concurrency regression coverage showing abandoned claims recover, live claims remain protected, and one immutable terminal receipt is produced.

Written by the indexing model from the issue text.