Clean up release holds after ambiguous acquisition

A hold request may succeed server-side even when its reply is lost or has an invalid identity. Use a unique owner token and attempt release whenever acquisition cannot be validated; include both acquisition and cleanup failures in the reported error. At the end of a rollout, report failed release unless a fresh service inventory proves the hold-owning process was replaced. Otherwise admissions can remain closed until the hold expires, and a reported success hides the operator action needed to recover. This rule does not replace the zero-work check before each mutation.

Applies when: A deployment client acquires a bounded admission hold through an unreliable network. Keywords: release hold acquisition cleanup ambiguous response owner token ingress replacement