fix(router): preserve in-flight ownership and release v4.8.1

[kevintseng]

Summary

• preserve same-delivery in-flight ownership without comparing Promise objects, resolving the remaining CodeQL missing-await finding
• add a synchronous reentrancy regression test that fails under unconditional cleanup
• release the security hotfix set as v4.8.1 with aligned package, plugin, docs, changelog, and upgrade-smoke metadata

Why this follow-up is needed

The first alert #135 rewrite still triggered CodeQL. A simpler unconditional cleanup was rejected after independent review demonstrated that reentrant delivery could delete a newer in-flight owner and start a third transport attempt. This candidate uses a plain entry object as the ownership token, retaining the original race guard while avoiding Promise comparison.

Verification

• full prepublish gate
• 211 test files; 2,808 passed, 9 platform-specific skipped
• packaged artifact install and MCP lifecycle smoke
• public v4.8.0 to packed v4.8.1 upgrade, data readback, and forced-failure path
• packaged dashboard E2E
• release verification, documentation parity, generated mirrors, and consumer dependency audit
• fresh defensive-security review, including an unconditional-delete mutant and direct reentrancy/rejection harnesses

No local npm publish is used. Publishing remains attached to the GitHub Release workflow.