UK staging lease (4 h) is shorter than the qualify job's 330-minute limit #662

Found in the independent review of #660.

stage_attempt writes expires_at = staged + timedelta(hours=4) (src/policyengine/provenance/uk_qualification.py, about line 1102). attempt_is_recoverable treats an expired attempt as abandoned even while its owner run is live, unless replay/request.json exists, and qualify writes that file only after the gates finish. The lease dates from when qualify had 120 minutes, so it was twice the limit. #660 raises qualify to 330 minutes, which makes the lease shorter than the limit.

Effect: if the gates ever run between about 240 and 330 minutes, the next catch-up re-stages a live attempt. That force-pushes a new candidate commit, un-readies the PR and queues a duplicate qualification. It's churn, not a deadlock. Today's gates are projected at about 140 minutes, so this doesn't trigger now.

Fix: raise the lease to at least 6 hours, ideally as a named constant tied to the qualify timeout. Update the 15 recovery tests in tests/test_uk_qualification_pipeline.py that stage at T and evaluate expiry at T+4–5 h (e.g. test_newer_abandoned_stage_recovers_despite_an_older_replay_request, test_forced_stage_recovery_binds_the_terminal_receipt_it_supersedes[*], test_resolution_preserves_authorization_to_recover_forced_work[expired-*], test_runs_resolved_on_different_main_commits_never_both_stage, test_cross_base_recovery_allocates_new_keys_without_overwriting_evidence), plus test_stage_records_owner_and_expiry_immutably, which pins 10:00 → 14:00.