[ligon]

A clean Codex exit could be classified as a crash while the runner's own checkpoint capture still held a database. Move the existing holder scan into Checkpointer.final after the in-flight capture drains and before the final capture starts. All observed holders still prevent sealing, and scanning consumes the existing final-capture budget. Unclean exits remain crash candidates; stalled captures still skip final publication.

Closes #70.

Validation at 7730000:

• Full Savio suite: 2,476 passed, no failures or skips, in 331.45 seconds. Dedicated job 40652505 on n0035.savio4 used a receiving-node checkout; import/source receipts confirm the tested revision. Includes native Codex sealed restore, same-allocation reuse, holder, final-capture and deadline checks.
• Both Python 3.9 and 3.11 CI jobs and docs are green (run 41072410857).
• New regressions hold a real SQLite reader across finalization, require classification after its release, and cover remaining holders and unclean exits. Two cases fail on unchanged c09d361; all three and the existing shared-deadline regression pass with this correction.

Evidence: /global/scratch/fsa/fc_jevons/ligon/burst/sucoder-issue70-9j44nb32/ contains test-head, import-path, full.log and full.xml. The initial local suite was deliberately interrupted after 15 passes to keep native acceptance outside the managed coordinator.

The prior-art ledger records invariants and direct callers. GitNexus impact/change detection could not load libssl.so.3; manual caller/diff review was used. Self-reviewed; no independent review. No holder exemption, timeout increase, or placement/recovery-policy relaxation.