Add leased webhook update inbox contract

[trakhimenok]

What changed

• Add a persistence-neutral webhook update inbox keyed by platform, bot, and provider update ID.
• Define atomic Claim, Complete, and Fail operations with lease IDs, attempts, outcomes, and timestamps.
• Distinguish acquired, already-completed, and actively-leased updates.
• Extend the framework fake state store for adopter tests.

Why

Webhook providers deliver at least once. A single “last update ID” cannot safely handle redelivery, concurrency, or out-of-order updates. This contract lets runtime adapters suppress the same provider update without suppressing distinct out-of-order updates.

Validation

• Contract tests pass.
• The companion DALgo PR covers initial claim, active-lease contention, expired-lease takeover, completion suppression, failure retry, and stale-lease rejection.

Rollout

This is the first PR in a dependency stack: store contract → DALgo adapter → framework/Telegram runtime → Debtus business idempotency. Persistence retention/TTL will be configured before production rollout.