fix: close audit punch-list #44–#70

[nficano]

Summary

Closes the open audit punch-list issues #44–#70 in a single coherent batch
of behavior fixes, doc corrections, and tests. Each section below maps
back to its issue.

Bug fixes

• ARCPClient.listJobs steals envelopes from the shared receive() flow #58 ARCPClient.listJobs no longer steals envelopes from concurrent
  receive() subscribers — the transport flow is fanned out through a
  shared mutex'd waiter map.
• Do not negotiate a binary encoding outside the advertised intersection #51, Reject sessions only on required-feature mismatches, not unknown extensions #57 CapabilityNegotiation rejects only on required-feature
  mismatches and intersects binaryEncoding within the advertised set;
  unknown vendor extensions are silently dropped.
• Return Nack for malformed messages instead of ending the runtime loop #47 Malformed envelopes return a correlated Nack instead of
  ending the runtime loop.
• Implement or explicitly reject the session challenge flow #50 Session challenge flow either completes or rejects explicitly.
• Serialize SQLite store access to each JDBC connection #48, Enforce EventLog idempotency for envelopes without a session id #49 EventLog serializes JDBC access through a Mutex and
  enforces idempotency for envelopes without a session id (sentinel
  substitution sidesteps SQLite's NULL-distinct semantics).
• InMemoryJobInventory pagination cursor is unstable under concurrent inserts #59, InMemoryJobInventory has no eviction; terminal jobs accumulate forever #60 InMemoryJobInventory uses opaque, sort-key-tied
  pagination cursors and exposes evict + size for retention.
• JwtAuth has no clock skew tolerance and never verifies the issuer claim #61 JwtAuth honors allowedClockSkew (default 1m) and
  optionally verifies iss.
• Remove unsafe mutable collections from concurrent in-memory registries #52 Concurrent in-memory registries swap unsafe mutable
  collections for ConcurrentHashMap-backed maps with proper bounds.
• BudgetCounter silently over-consumes past zero and the contract is undocumented #65, BudgetRegistry.consume returns Ok for unregistered jobs, masking configuration bugs #66 BudgetCounter never overshoots zero and BudgetRegistry
  returns NotFound for unregistered jobs instead of Ok.
• Give AssembledResult content equality for its ByteArray payload #53, Avoid repeated decoding and byte boxing in ResultChunkAssembler #54, ResultChunkAssembler is not thread-safe and does not say so #67 AssembledResult gets content equality; the
  assembler avoids repeated decoding + byte boxing and documents that
  it is not thread-safe.
• revokeWithRetry has no backoff and only catches IOException #68 CredentialStore.revokeWithRetry uses exponential backoff
  and a broader retryable-exception filter.
• DefaultUpstreamErrorTranslator uses fragile substring matching and an "unknown" currency #69 DefaultUpstreamErrorTranslator uses structured cause
  matching instead of substring sniffing and the bogus unknown
  currency.
• Remove or implement the missing human-input sample task #55 Removes the dead human-input sample and adds an init-time
  check that prevents announcing a sample whose source is gone.

Docs

• Make the README and getting-started quickstarts runnable #44 README + getting-started quickstarts are runnable end-to-end.
• Correct conformance docs that overclaim runtime support #45 Conformance doc no longer overclaims runtime support.
• Add property-level KDoc across public message models #46 Property-level KDoc on the public message models.
• Capabilities.interrupt defaults to true, contradicting its own KDoc and RFC §7 #62 Capabilities.interrupt = true documented as a deliberate
  SDK exception to RFC §7, not a contradiction.
• README and docs treat Metric.unit as nullable; the field is non-nullable #63 Metric.unit is documented as non-nullable.
• docs/guides/job-events.md references JobStarted.jobId, which does not exist #64 docs/guides/job-events.md no longer references the missing
  JobStarted.jobId.

Tests + build

• Add direct unit tests for ARCPClient, ARCPRuntime, JwtAuth, BudgetRegistry, and MemoryTransport #70 New unit tests: JwtAuthTest, ResultChunkAssemblerEqualityTest,
  BudgetCounterRejectedTest, BudgetRegistryTest,
  UpstreamErrorTranslatorTest, MemoryTransportTest,
  ListJobsFanOutTest, plus expanded CapabilityNegotiationTest and
  ListJobsHandlerTest.
• Add aggregate Kover coverage verification for line and branch thresholds #56 Kover aggregation across :lib + :tests with line/branch
  coverage floors that fail CI on regression.

Test plan

• ./gradlew :lib:ktlintCheck :cli:ktlintCheck :tests:ktlintCheck
• ./gradlew :lib:detekt :cli:detekt :tests:detekt
• ./gradlew :lib:test :tests:test (rerun-tasks; all green)
• ./gradlew assemble
• CI passes on the PR