fix: the transition map carries the lease-expiry sweep's running-to-pending edge; the ordering docs name the cross-actor rotation

[rcbevans]

Closes #304
Closes #305

What

Two consistency fixes surfaced by downstream consumers building checkers against our public contracts. Neither changes runtime behaviour.

The transition map (VALID_TRANSITIONS)

The map describes itself as the canonical encoding of the job state machine, and its convention is to include every authorized transition, annotating the sweep-only ones (the pending and scheduled entries already do this for the deadline-exceeded sweep). The running entry was missing pending: the lease-expiry and heartbeat-timeout sweeps send a reclaimed running job back to pending whenever attempts remain, and record the state change with from_state=running, reason=lock_expired. assert_valid_transition never gated the sweep, so no behaviour was wrong, but anyone consulting the exported map to learn which transitions TaskQ can emit would conclude this one cannot happen. It happens on every lease expiry. The edge is added with the same annotation convention, and pinned.

The ordering docs

The mode table gave strict_fifo as priority DESC, scheduled_at, id and called it a simple priority queue. That ordering holds within one actor; across actors sharing a queue, the round's eligible cut orders by pending_rank first, so each eligible actor's rank-1 job admits before any actor's rank-2 (the deliberate anti-starvation rotation, stamped via actor_claimed_at). The table now says which ordering it means, and the CTE walkthrough's eligible line now carries the ORDER BY every other stage already shows.

Verification

Red-green: the map pin failed before the fix and passes after (the transition families: 89 passed); lint clean; pyright 0 errors.

Followup: the shutdown e2e pins carry the merged interrupt semantics

The e2e lane's first run on this branch exposed three pins still asserting the pre-#300 refund contract that this PR's sibling fix (#300, merged) replaced: the SIGTERM drain's release predicate demanded `attempt == 0` and the watchdog-trip and replacement-worker pins asserted the un-spent increment. The merged contract spends the interrupted claim's attempt (refund would re-create the attempt epoch the interrupted handler still holds). The pins now assert the merged semantics: the drain releases `pending` with the increment standing, the watchdog trip releases held with it standing, and a deploy costs one attempt of budget. Verified locally against main's code before the push: the five shutdown-family e2e tests green.