Drop a release transaction when its task fails

The supersession rule fires on TaskLeased, and a failed task is never
leased again. Run 12's rig task reached retry_limit still holding a
transaction whose commit the coordinator refuses permanently, so it kept
asking every five seconds with nothing that could ever change.

Terminal means terminal: TaskFailed now drops the transaction and
quarantines the session even when the anchor was pushed. Blocked keeps
the old rule, because a reopen still produces a successor that can pick
the anchor up.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CVbaKucEYBjMqVeUgJUsc1

cmd/orchestra-worker/main.go

@@ -1395,8 +1395,12 @@ func (w *worker) once(ctx context.Context) error {
 			// mapping protects nothing. F30: a transaction stuck at "prepared"
 			// held the session forever once its pane was gone, health() kept
 			// reporting ActiveTask, and the harness never leased again.
+			// A failed task is terminal: no successor will ever lease it, so
+			// its anchor protects nothing and its transaction can only retry
+			// a refusal forever. Blocked is different, because a reopen still
+			// produces a successor.
 			tx, releasing := w.releases[e.TaskID]
-			if !releasing || tx.Ref == "" {
+			if !releasing || tx.Ref == "" || e.Type == "TaskFailed" {
 				if releasing {
 					delete(w.releases, e.TaskID)
 				}