safe-fs: preserve a per-handle publication token independently of namespace revision

[kamilio]

ObjectFilePublicationStore.publish receives only expectedRevision plus size/mode/signal. Hosts that reserve publication capacity during writable acquisition need the exact retained lease when publishing. Encoding the lease ID into revision breaks the public immutable-read conformance requirement: independent acquisitions of one namespace generation must report the same revision. A path/revision lookup is ambiguous when two writers hold that same generation.

Validated in poe-internal/poe2 PR #14982: CI run 35956382627 fails object publication: immutable reads survive replacement with acquisition did not observe the published namespace revision after the consumer encoded updatedAt:leaseId. Current upstream still drops all version fields except revision/stat/read/close before publication.

Add an optional bounded opaque publication token on ObjectFileVersion, preserve it through descriptor validation, and pass the current token in ObjectFilePublicationOptions. Keep expectedRevision stable and retain all existing conformance cases. Add a regression with two distinct acquired handles sharing one revision, sequential flushes, and updated tokens from each publication. Existing stores without tokens must retain their behavior.

[kamilio]

Verified on remote main in 738cacd. The two-writer token regression failed before the fix and passed afterward; the maintained SafeFS build, all 4,957 SafeFS tests, and focused lint passed in https://github.com/poe-internal/poe2/actions/runs/35958763543. Independent acquisitions retain stable namespace revisions; each descriptor forwards its own current publication token. Consumer integration is prepared and awaiting a successful containing release.