When call ingress creates a durable session and the runner rejects bot admission

General lesson: When call ingress creates a durable session and the runner rejects bot admission, the failure path needs an explicit terminal reconciliation check. A provider leg ending and a LiveKit room disappearing do not prove the database session finalized. This applies to telephony canaries that fail before an agent worker starts. The gap should be tracked separately from media quality or process isolation because no worker or audible response exists to evaluate.