Serialize Codex probe pairs and preserve final service tiers

[HTExplicit]

Concurrent validations for different models or client windows on one account can currently interleave their two STATE shots: A mint, B mint, A continuation, B continuation. Each shot releases the shared execution permit. That violates the pinned ranxi probe's same-account serialization contract and can invalidate the observation while another validation is running.

Hold one existing account/global execution lease from the target's mint through continuation. Nested shots reuse that lease, and source acquisition still finishes before the target lease begins. Other accounts retain access to the remaining execution slots; cancellation releases capacity. STATE acceptance, account configuration, lease expiry, model selection and business retry behavior remain unchanged.

Qualification also reconstructed service_tier solely from a routing hint that intentionally omits default, auto and scale. Carry the final body/frame tier in local request context for HTTP, passthrough and WS, use it in the probe body and proof key, and retain it when rebinding preparation to the caller's cancellation. The actual business body and routing hint format remain unchanged.

Validation: a deterministic regression reproduced interleaving in both public preparation and administrator diagnostic contexts before the fix and passes afterward. Focused checks cover nested lease ownership, cancellation, distinct-account progress, shared-waiter cancellation, configuration cancellation and bounded candidate replacement. Native HTTP tool-continuation checks compare both probe and business tiers for priority, default, flex, ultrafast and omission; default/auto/scale/omission proofs remain independent despite identical hints. Existing WS diagnostic continuation and configured-prewarm checks pass. The v6 live failure receipts are retained; code checks do not by themselves establish that all upstream failures are resolved. Live verification follows the fixed-version deployment.