fix: Bind background tier jobs to durable database selection

[buildingjoshbetter]

Adds durable selected-job binding to the background handoff in #824. Path and source-epoch checks alone can admit a stale same-epoch clone. Selection now writes a fresh, bounded marker through the accepted connection; the worker validates that exact marker after reopening.

The additive APIs select, check/open and end a selected job. They own short transactions on clean connections, reject a live competing selection, require an explicit previous ID to replace a terminal marker, and compare full identity before marking only that job failed or cancelled. They never install source tracking, retain a corpus, write per-page status, change active configuration or activate a tier.

Marker schema/types/identity and TEMP/trigger side effects are checked. Byte-length admission precedes Python payload materialization, including embedded-NUL suffixes. Rollback and post-commit uncertainty propagate without a success result or follow-up status SQL. Existing nine identity definitions and all 104 prior assertions remain unchanged.

Validation:

• Sequential GPUBox installed-wheel/full gates with real sqlite-vec and the existing opt-in file-backed identity test: combined 3,220 tests / 2,733 subtests; publication 3,088 tests / 2,088 subtests. Both exit 0, with 17 explicit skips, 3 deselections, no timeout and no OOM kill.
• 31 new synthetic tests and 25 unchanged local identity tests passed. Independent actual-source/in-memory review passed all 64 probes.
• Two removal controls each fail one assertion with zero harness errors: missing selected-marker validation admits a pre-selection clone; missing byte preflight reads a forbidden oversized payload.
• Ruff, Python 3.10 syntax, exact source/manifest/remote hashes, diff and public-identity/privacy checks passed.

Combined full log SHA256: b24672014fea5c86f685155ea5ed4435d692cd86a1b93109ab94d55c925625e7.
Publication full log SHA256: af74d80c0002ddb80b5a76f09aab5677855105b84bbc7ac130edfa489ed58463.

This is an unused prerequisite. Public manager adoption, successful job retirement, certified activation and config/runtime reconciliation remain pending. Known-current caller association and a cooperatively stable path remain required. The marker rejects a database cloned before selection; it does not prove native SQLite-FD association, ABA safety, or distinguish a clone copied after the marker. No production memory reduction or resolution of the original Mac incident is claimed.

Refs #795 and #756. Stacked on #824; no issue closure or release claim.