Phase 1 follow-ups after Codex gate approval (#440)

[Clarion1631]

Follow-up to #440 (Phase 1: receipt intake core). The Codex gate APPROVED round 24 (2026-09-03 19:43Z on 763d40dd): the cleanup claim is renewed under the per-path lock immediately before deletion, outlives the bounded storage call, and uses the invocation deadline. Nothing blocking remains; this issue holds the non-blocking items so they are not lost.

From the approving round (non-blocking)

1. Strengthen the claim-expiry regression. Pause an actual deletion past the ORIGINAL claim expiry while a publisher attempts takeover, and assert the publisher is refused until the renewed claim lapses (real Postgres, two connections, pre-fix control). The current test proves the renewal happens; this one would prove the takeover cannot interleave.

Companion work outside this repo

2. Mobile app (gtr-probuild-mobile) must ship the new upload contract before feat(receipts): ReceiptIntake state machine + intake endpoint + worker (pipeline v2 phase 1) #440 merges: /start requires sha256 and returns a union (upload with uploadUrl + uploadLease, or settled); /finalize must echo uploadLease and handle 409 lease-stale / 409 lease-conflict by restarting.

Ops

3. Prod apply before merge: APPLY_EXPECT_PROJECT_REF=<ref> node scripts/apply-receipt-intake.mjs --target prod (creates the intake table that feat(expenses): project + phase attribution, tax paid at source (pipeline v2 phase 3) #442 and feat(receipts): Receipts tab, missing-receipt chaser, Chat cards, nightly QBO bank pull (pipeline v2 phase 2) #443 build on; both must merge after this PR).