[scanner] Regression test: contributor-claimed, PR-covered issue refuses a second epic-driven implementation #17302

Part of #17292

Failure evidence. On 2026-11-08 this sequence ran to completion with no gate firing: the hive filed #17243 → contributor claim (15:11:02) → the contributor's PR #17248 covers it (15:26:49) → the claim was released lease revoked (15:27:45) → the hive's epic-driven second implementation #17250 opened (15:34:26) and merged (15:42:43).

Code locations exercised

• src/pkg/dashboard/contribute_leases.go revokeLease → src/pkg/dashboard/claims_api.go releaseClaimForLease → src/pkg/claims/claims.go ReleaseByHolderID (claim kept or converted on coverage: [scanner] Keep the contributor claim when their PR covers the issue instead of releasing it on lease revoke #17300).
• src/pkg/github/pr_request_watcher.go handleOnePRRequest → src/pkg/github/pr_request_claims.go validatePRRequestClaims (target gate: [scanner] Refuse to start or open a PR whose Fixes/Closes target is claimed or covered by another author #17298).
• src/pkg/github/stage_facts_sink.go ledgerCoveringPR and src/pkg/stageengine/facts.go ClaimFact (stage stays 040 throughout).

Expected behaviour
A single end-to-end regression test replays the exact sequence against the ledger, the contributor lease hub and the PR-request watcher (with a fake GitHub client):

1. The hive files issue N (unclaimed, help wanted).
2. Contributor C claims N (ledger + lease).
3. C's PR M with Closes #N opens; N derives stage/040-covered-by-pr.
4. C's lease completes. The ledger still shows N held by C (PR-held).
5. A hive agent working from an epic requests a PR with Fixes #N from a different principal. The request is refused, a single needs-decision-style comment naming C / #M is posted on N, and no PR is opened.

Acceptance criteria

• The test fails on today's v5 (step 5 opens the PR) and passes once [scanner] Refuse to start or open a PR whose Fixes/Closes target is claimed or covered by another author #17298 and [scanner] Keep the contributor claim when their PR covers the issue instead of releasing it on lease revoke #17300 land.
• No time.Sleep; it uses an injected clock.
• It lives beside the existing watcher/ledger tests (e.g. src/pkg/github or src/cmd/hive wiring tests) and runs under the normal go test CI target.

Blocked by #17298 (target gate) and #17300 (claim kept on coverage).

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88