A held lease — a snapshot capability handle returned by Dust.lease/3 and
Dust.renew/2.
Authority lives on the server: this struct is a point-in-time snapshot, not a
live lock. token is the server-stamped fence token (monotonic, preserved
across renew); pass the whole struct to Dust.renew/2, Dust.release/1,
or a write's fence: option.