fix: make ticket failure precondition atomic

[tom-sapletta-com]

Summary

• add optional atomic expected_updated_at enforcement to ticket failure transitions
• expose POST /tickets/{id}/fail-if-current, where the precondition is required
• return HTTP 409 without history, event, or state mutation when the ticket changed
• support single-file and sharded YAML plus append-only evidence projections
• advertise ticket.fail.expected_updated_at in /health

Why

Subactor Core's stale-execution watchdog can re-read a candidate before failing it, but without a server-side compare-and-set another process can still update the ticket between that read and the failure mutation. The distinct endpoint is important for rolling upgrades: an older Planfile returns 404 instead of silently ignoring an unknown JSON field and performing an unsafe legacy failure.

Verification

• full local suite: 378 passed, 6 skipped before the endpoint-only follow-up
• endpoint and lifecycle regression suite: 74 passed after the follow-up
• hosted CI succeeds on exact head 1e40d0f
• Ruff checks on changed sources/tests pass
• git diff --check passes