Scoped acquisition handle for one provider session.

A registrar belongs to one PtcRunner.Kernel.ProviderSession acquisition scope and is inert until activated. Successful acquisition commits one provider close operation for the scope; failed acquisition aborts it. Each scope has a private signal owner for process roots. A root monitors that owner and registers synchronously before its start operation returns.

A handle cannot be retargeted: every field is covered by the sealed attestation valid?/1 checks on entry, so mutating one invalidates it. It can be constructed — new/8 attests whatever arguments it is given, and PtcRunner.Kernel.Attestation is explicitly not a security boundary against code running in the same VM. What contains a minted handle is the session's own authority rather than this struct: it honours only scope references it opened, fences activate and commit with the deadline it sealed for itself rather than the one the handle carries, and clamps an abort to a budget it installed.