fix(cluster): deliver holder CR refusals through outbound ring

[sqlrush]

Summary

• Accept valid holder-produced CR refusals in the outbound ring while preserving the forwarding-master identity.
• Keep malformed identities, nonzero holder page LSNs, and connection-generation drift rejected.
• Add a regression exercising the production refusal producers, queue/drain, checksum and requester decoder together.
• No wire-format, timeout, storage-format or stable-release changes.

Verification

• Regression before fix: holder refusal rejected at enqueue; 1 of 39 tests failed.
• After fix: outbound unit suite 40/40 and R4 route-policy suite 117/117 passed on Linux with assertions enabled.
• Linux build and installation passed; formatting and whitespace checks passed.
• Source-removal census rebound to the repaired product bytes; all 7 census tests passed with unchanged validation rules.
• Existing four-node PRE reused retained, cleanly stopped data. Restart/full-row comparison passed; no data rebuild or earlier-lane rerun.
• First PRE sample: measurement/warmup error counts zero, full-row comparison and pre/post health/state checks passed, but 48 UPDATEs were cancelled during client close. PRE is INVALID, and the unchanged first-failure policy stopped further samples.
• Reply-period counter fell from 1,117 in the previous first sample to 1 in the new sample (whole workload+verification scopes). Throughput was 547.80 TPS in this invalid sample; no stable performance improvement is claimed.

Draft is retained pending investigation of unfinished UPDATEs and a valid PRE result. GitHub CI is running after the fingerprint-only follow-up; that follow-up does not change the runtime-tested backend bytes.

This PR does not authorize a merge or a new release.