fix(control): keep failed command paths excluded

[frahlg]

What this fixes

This closes four command-path gaps found in the stable-release audit:

• A registry ErrControlBlocked now excludes the driver even when the original refusal and a failed default recovery are joined into one error.
• Refusal streaks are tracked per JSON action, so a successful hybrid battery command cannot erase repeated PV-curtail failures.
• Automatic loadpoint dispatch stops when Core has marked the charger offline, including pause/resume wake work.
• EV pause/resume and Core default, exclusion, timeout, removal, and shutdown now share the registry's per-driver owner. A resume is valid only inside the same uninterrupted wake cycle.

The internal wake-cycle ID stays in Go. The driver JSON and public API do not change. Public manual driver sends keep their existing health behavior.

Failure proof

Tests fail on the old tree when:

• default recovery crosses an earlier EV pause and the stale resume reaches the runtime;
• removal or lifecycle cancellation leaves a queued resume alive;
• one blocked charger stops the next loadpoint;
• a registry block leaves a driver online;
• one action's success clears another action's refusal streak; or
• an excluded loadpoint sends again inside its retry window.

The new barrier tests make those races deterministic. A timed-out caller releases the loadpoint tick, while the registry owner keeps the same-driver call serialized so a second command cannot overlap it.

Verification

• go test -race ./internal/drivers ./internal/loadpoint ./internal/api ./cmd/ftw
• make verify — 167 optimizer tests plus all Go, migration, boundary, vet, and build checks
• independent final review: GO, no P0/P1

Coordination

Keep this PR in draft until file ownership is resolved:

• feat(web): turn a driver's write path on from Settings #769 already owns overlapping main.go and command-outcome code. Its author must confirm this safety stack lands first, then feat(web): turn a driver's write path on from Settings #769 must rebase.
• fix(control): keep autonomous defaults ahead of stale commands #798 overlaps the registry owner. It is already marked PAUSED / NOT READY and must be rebuilt on this path if resumed; do not merge its current head.

This PR contains two reviewable commits: command outcome/exclusion first, then the EV/default actor boundary. The rejected intermediate mutex design is not in this branch history.