fix(ri-exchange): release or explain the idempotency claim when a direct execute's claim lands after the deadline #1845

Follow-up from claude-nibblets' review of #1841 (#1840).

When a direct RI exchange's idempotency claim succeeds only after the execution deadline, #1841 correctly never calls the provider and finalizes the audit row failed ("not submitted to the provider: … finished after the execution deadline"). But the claim still holds the idempotency key for riExchangeIdempotencyWindow (15 minutes, internal/api/change_idempotency.go:30).

So an immediate retry of the identical exchange gets the 409 "an identical RI exchange claimed this submit … may be running, may have committed". That's safe, but misleading, because nothing was sent.

Options:

• release the claim on that path, if the store supports it safely;
• or make the 409 text point the caller at the audit row's outcome.

Low priority; the audit row already records the truth.