sdk-go: durable steps in the executor client

[kartikeya-27]

PR #928 shipped the executor client with side_channel and lease. It does not
advertise steps, and this is the other half.

steps is the one capability that fails rather than degrades: a durable step
that silently did not commit is a step that will re-run a charge. So the client
does not advertise it today, which is the contract's own rule rather than a gap
left open by accident — a step call simply is not available.

What it needs, none of which the wire hands over:

• A local StepSequence. crates/flexiq-core/src/step/sequence.rs is the
  reference and is core-internal; a Go executor reimplements it. seq is
  gapless, 0-based, and equals the number of rows already stored — not the
  positional cursor, because a keyed hit can land out of order and leave the
  cursor behind.
• Snapshot decoding. JobStepsFrame.snapshot is a JSON metadata array, one
  \n, then every step's blob concatenated in seq order, each blob's length
  taken from that step's result_len. The decoder must be strict: a snapshot
  that silently came back short is a memo that silently went missing. No frame
  means an empty snapshot, never an unknown one.
• step_key derivation. name#occurrence unkeyed, name:key keyed. The
  occurrence counter is per name and per attempt, and a refused request does not
  spend one. A keyed call never touches the counter, so adding one cannot shift a
  later unkeyed call's number.
• Ack correlation on (job_id, seq). Register the waiter before sending
  the commit — a fast scheduler can answer before anyone is listening. The wait
  is bounded by min(step_ack_timeout, the job's remaining timeout). already
  is a success: it is a retransmission after a lost ack.
• The two-phase sleep. step_commit with kind: Sleep and a candidate
  deadline, then — only after the ack, which echoes the deadline storage actually
  settled on — a slept frame that ends the attempt. A deadline already elapsed
  is an ordinary memo hit and sends no frame at all.
• Refusal classification from the enum, never the message. StepFailure is
  retryable, permanent or superseded, and a superseded commit means another
  attempt owns this job now and this one must stop without writing.

Every step frame carries the dispatch's lease, like every other frame that
advances an attempt.

Prerequisite reading: crates/flexiq-core/BINDING_CONTRACT.md, the durable-step
sections; contracts/REMOTE_SDK_CONTRACT.md.

[stromanni]

Closed by #937, squashed as 99a41c24.

All six bullets landed. The rules the other shells hand to flexiq_core::step across their FFI are reimplemented in sdks/go/internal/step — Go links no Rust — and the executor side carries the surface, the (job_id, seq) correlation and the settlement.

Worth recording for whoever reads this next:

• The swallow latch is narrower than it first looks. §7.7 of the durable-steps design scopes it to a sleep and a divergence, and the Node plan spells out that it only bites on a swallowed divergence. So an ordinary refusal the body caught and returned past is taken at its word; a divergence fails the attempt whatever the body does, and a superseded commit settles nothing at all.
• seq for new ground is the number of rows already stored, not the cursor. A keyed hit claims a row out of order and leaves the positional walk behind.
• The Go JSON decoder is looser than serde in two ways that matter, both caught in review: a bare null decodes into a slice as nil with no error, and an absent or null required field takes a silent zero. Either one turns a damaged snapshot into "no steps recorded", which runs every step body again. Both are refused now.

Verified against a real flexiq-server as well as the bufconn suite: a step survives the attempt that wrote it — the scheduler encodes the snapshot in Rust, the client decodes it in Go — and a job with two sleeps does not restart the first on the second wake.