[moetemp]

What changed?

This PR adds the withdrawal rules of temporalio-streams to the Lua scripts.

• A Local Activity write with its run's task facts withdraws the Records of the run's tasks that never completed, and of the lower attempts of its own task and of the completed task. It uses the attempt and started time that Core sends (temporalio/sdk-rust#1703).
• Each withdrawn task has its own ow|<run>|<task key> field, so the fence reads one field.
• tf|<run> keeps the task facts of the run's highest task. A later write of a task that these facts show never completed is fenced, since a task can fail before its call writes.
• A Local Activity write with no task facts, as from an older Core, still goes in oa|<run>, so a later write's facts can withdraw it.
• A retry run's first write withdraws and fences the previous run, so the Redis Store declares RUN_FENCE. An empty batch that withdraws a run keeps its Producer's held epoch.
• The append script refuses malformed task facts before its first write.

It depends on #1, and on moetemp/sdk-rust#218, which has the rules and their cases. It replaces the Lua part of moetemp/sdk-streams#50.

Why?

The orphan rule is the hardest Lua to review, so it's in its own PR.

Some Records stay, in both Stores. A failed task that no later write covers keeps its Records, and so does a failed task older than the last 100 that Core sends. docs/redis.md lists these and the other cases.

How did you test it?

The shared Store and service suites run on Redis with the rules' cases, standalone with a replica and on a cluster of three primaries with one replica each. tests/acl.rs also runs an orphan append and a retry run's create with only the documented commands. A unit case checks that malformed task facts write nothing. The parity check of #1 also runs retry-run withdrawals and Local Activity task facts on both Stores. CI also runs Redis 7.0 and a FIPS build.

[moetemp]

Closing this. Supersession moves to an opt-in client helper, so the Redis Store keeps no withdrawal or task facts. #1 is now the base Store in that final form, with no withdrawal machinery, and #3 rebases onto it. The withdrawal rules are no longer part of the Store.