[scanner] Refuse to start or open a PR whose Fixes/Closes target is claimed or covered by another author #17298

Part of #17292

Failure evidence. #17243 was claimed by contributor Karibhou at 15:11:02 and covered by their PR #17248 (Closes #17243, issue at stage/040-covered-by-pr from 15:26:49). At 15:34 the issue author's own hive opened #17250 (Fixes #17243) while continuing epic hivecommons/crux#114. No claim was ever recorded for that agent, and nothing refused the start or the PR-open. #17250 merged and #17248 was closed as superseded.

Code locations

• src/pkg/github/pr_request_claims.go: (*Client).validatePRRequestClaims. For each closing reference it resolves the issue (ParseClaimedIssues → Issues.Get) but only checks incompleteIssueReason (downgrade to Refs). It never asks whether the target is claimed or covered by someone else.
• src/pkg/github/pr_request_watcher.go: (*Client).handleOnePRRequest calls the gate above. notifyAgentStart(..., AgentStartSignalPRRequest) fires for every req.IssueN before any claim check.
• src/pkg/github/issue_claim_gate.go: issueClaimGate / IssueClaimBlockReason refuse only needs-human, hold, blocked, park and never-claim. IssueDispatchBlockReason adds the open-PR guard (Scanner dispatches issues that already have an open linked PR; duplicates escalate to owner instead of auto-resolving #14799), but it runs only when a claim is requested (src/cmd/hive/claimswire.go, ledger SetAdmissionCheck; hive-open-issue claim in issue_request_watcher.go). Epic-driven work that never claims the issue skips it entirely.
• Ledger lookup for a live contributor claim / covering PR: src/pkg/github/stage_facts_sink.go ledgerClaim / ledgerCoveringPR (prClaimLookup); src/pkg/stageengine/facts.go ClaimFact (the "dispatch is withheld" note at ~line 217 covers dispatch from the issue, not work that arrives via an epic).

Expected behaviour (fail closed)
Before an agent starts work that will close issue N, and again when hive-open-pr is processed for a body that closes N, resolve N's state. This applies whether the work was dispatched from N or arrives from an epic that files or closes N. Refuse in either of these cases:

• N has a live claim held by a different principal (contributor, person, or another agent).
• N is stage/040-covered-by-pr by an open PR from a different author.

On refusal, reject the PR request with a policy reason and post one needs-decision-style comment on N: "already claimed by X / covered by #M; the owner decides whether to proceed". The issue author's own hive gets no special pass. Fail closed when the claim/coverage lookup errors.

Acceptance criteria

• validatePRRequestClaims (or a gate beside it in handleOnePRRequest) rejects a closing reference to an issue claimed by another principal, or covered by another author's open PR, with a policy reason (rejectPRRequest, gate claim).
• The kick/start path for epic-driven work runs the same check before work starts on a target issue, and before notifyAgentStart books a start on it.
• One comment on the target issue per refusal, deduplicated by marker.
• Unit tests in src/pkg/github cover: contributor-claimed target refused; target covered by another author's PR refused; the agent's own claim/PR allowed; lookup error refuses.

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88