queen(actors): PgLink made safe - node incarnations, a fenced lease on its own thread, mail acknowledged after it is handled #1714

Part of #1712 (item 6: PgLink fencing and node incarnations).

Problem

createPgLink has no caller yet, and there is no TRIOS_ACTOR_NODE at the deployed head. Before it gets one, the six defects that reading queen-actors-pg.ts and queen-actors.ts found are each reproduced by a failing test on actors-next (b7aaf6b):

• Mail rows are deleted before they are handled, so delivery is at most once. With three lost read answers, 11 of 20 messages were lost (pglive).
• Pid generations restart after a process restart. A restarted node handed out its old pid, and mail written for the old process reached the new one (memory net and pglive).
• The heartbeat shares the event loop with the actors. A 25 s synchronous turn gave a false node-down (pglive, child process).
• A node its peers consider dead keeps running and sending. 12 messages arrived after its peer saw it down, and its actors were still alive. It also came back up when its lease came free (pglive, and the memory net).
• Any node-down resolves every pending spawnOn to null, whatever node it targeted (memory net).
• Mail to a dead node never expires: 5 rows were still there after the TTL (pglive).

What this adds

• The rules are the card specs/queen/netlink.t27 (spec(queen): the node link made safe - incarnations, a fenced lease, mail acknowledged after it is handled t27#8276), vendored as netlink.wasm plus queen-netlink-card.gen.js, with a PIN check.
• queen-actors-pg.ts:
  • A start claims the next incarnation in one transaction.
  • The lease is renewed by a worker thread with its own connection, and only while the loop turns.
  • Every write (renewal, send, acknowledgement, expiry) is fenced in SQL by the incarnation and the lease.
  • Mail is read, handled, then acknowledged, with dedupe by row id.
  • Each heartbeat reads every lease through peer_change/peer_up, and expires mail for incarnations that are over.
  • The node fences itself on must_fence.
• queen-actors.ts:
  • Pids carry the incarnation.
  • A node-down ends only what waited on that incarnation (lost_with).
  • A fenced system stops every actor quietly, and from then on sends and starts nothing.
• queen-actors-net.ts: the memory net plays the store's part (incarnations, expiry, self-fence).
• pg-migrate.ts (QUEEN_ACTORS_SQL): incarnation on queen_actor_node; to_inc, from_node and from_inc on queen_actor_mail. These are additive, IF NOT EXISTS.

These are pure fixes: the link has no caller, and a node without a link (the reviewer in production) keeps section 1's pids and code path.

Acceptance

• Every defect test above is green, and the api suite has no new failure.
• A chaos benchmark runs the same script before and after: mail lost when delivery is killed mid-batch, duplicate handling, pid reuse across restart, false node-down under a held loop, a frozen node (SIGSTOP) still writing after its peers saw it down, and per-message latency. The numbers are posted on Queen moves to the actor model: the rule in every AGENTS.md, an MVP, a benchmark, then the swap t27#7851 and in the PR.