fix(x-mode): commit the offer marker only after its wake is emitted, and answer each request once

[quinnbot-ai]

Fixes a durability defect in the X-mode relay poll, found during a fork sync review of upstream kunchenguid#745.

The defect

bin/fm-x-poll.sh claimed the one-wake marker state/x-context/<request_id>.offered.json and only then printed the x-mention <request_id> line that becomes the watcher's wake payload.
That marker is the poll's authority for silence: the check above it returns early for any request that already has one, so every later relay re-offer is discarded without output.
A poll that stopped between those two steps left a marker with no wake - the mention stayed pending in the inbox, every re-offer was swallowed, and it was never surfaced again for the rest of the seven-day retention window.
The window is reachable in normal operation: the watcher terminates a check's whole process group on shutdown and on its per-check timeout.

The fix

Poll side - claim, emit, then commit.
The claim still comes first, but it records wake_emitted:false, and only a marker whose wake was actually written suppresses a later offer.
An interrupted offer is therefore re-offered rather than silenced, costing at most one repeated wake.
A marker written before this field existed counts as emitted, so upgrading cannot replay an already-answered mention.

Consumer side - the wake is at-least-once by design, so exactly-once is enforced where the public action happens.
bin/fm-x-reply.sh claims state/x-context/<request_id>.answered.json before posting an initial answer and confirms it only on a 2xx.
A confirmed marker refuses a duplicate with exit 10; an unconfirmed one exits 11 and escalates rather than looking answered.
The claim is released only when the answer provably did not land, and follow-ups are excluded because they are legitimately repeated.

Design note

An earlier iteration kept the wake exactly-once with a poll-side recovery subsystem and was removed deliberately.
The private-artifact helpers offer create-exclusive publication but no atomic take-over, so each variant moved the concurrency race rather than removing it.
Preferring at-least-once wakes plus a consumer-side guarantee needs no new concurrency primitive and puts the guarantee where a duplicate would actually cause harm.

A residual delivery window remains outside the poll and is documented rather than hidden: the watcher reads the poll output, deletes the capture, and only then appends the durable wake record.
Closing it means changing the watcher's check dispatch and is tracked separately.

Tests

Colocated in tests/fm-x-mode.test.sh, hermetic on the existing fake-curl harness.
The poll crash window is reproduced by a poll whose wake cannot be delivered and by the durable state a killed poll leaves behind.
The consumer guarantee is proven by a duplicate answer refusing with exactly one relay post, an unconfirmed claim escalating instead of posting, a definite failure staying retryable, and the claim sparing follow-ups and dry-run previews.
Both new behaviors were verified to fail without their fix.

Validated through the no-mistakes pipeline: review, tests, documentation, and lint all green.