feat(wake): native wake path is a lease-gated fallback (#82)

- WakeMonitor gains optional leaseGate (DI, pure) between audit verdict and inject
- createNativeLeaseGate: native claims as native:<agent>, muted while a live chat session owns the channel
- claimOrSkip gains preemptPrefix so real chat sessions reclaim the channel from the native fallback
- tests 7/7 (cold-claim, preempt, mute-while-live, resume-after-stale, WakeMonitor honours gate)
- existing wake-monitor / codex-app-server-wake tests still green