Fix runtime history-transfer deadlocks and Google Chat failure status

[makeitfutureDev]

Switching a thread to /sudo could hang before engine startup when history transfer needed to rebuild a container: preparation counted the transfer's own lease as another occupant. Pass the lease, cancellation signal and progress callback through the carry path; bound preparation and preserve explicit Stop instead of starting transcript recovery.

Google Chat now propagates fatal receiver failures to transport health, stops intake and hides the failed connector. Pub/Sub 403 errors include a Subscriber-role and reconnect hint. Reconnection is protected against late failures from older connections.

Validation:

• Full regression: 3,181 passed, 24 opt-in skipped, no failures.
• Focused carry/runtime/lifecycle: 75 passed; Google transport/manager: 35 passed.
• Real disposable Podman container: Claude and Codex native-layout fixture histories survived roundtrips and mount-triggered rebuilds while carrying their own lease; cleanup passed. This is fixture proof, not real-engine conversation acceptance.
• Static checks, secret scan, security coverage and DCO passed.

Remaining acceptance: real-engine conversation cases and private QA registry updates are recorded as pending in TEST-PLAN.md. Google IAM grants are deployment configuration and require the project administrator; the code does not grant cloud permissions. Actual copy execution retains its existing 120-second CLI bound; preparation waits cancel immediately.