ADR-019/020: second review round — handle surfaces, enqueue semantics, payload bridge + mechanical fixes

ADR-019: mechanism-handle traits pinned (Queue/StreamHandle/Outbox/
Lock/JobHandle), Job/Schedule struct shapes, worker_id claimant
identity, core StopToken — closes the 'pin at implementation' residue
before ADR-017's amend-in-place window terminates at first release.

ADR-020: delay-wins-over-run_at precedence (honker parity), relative
expires, scheduler-fired stamps from derived queue defaults, serde_json
byte-level payload encoding.

Mechanical: overview/engine-postgres ADR tables completed through 020,
core-contract Errors section re-framed to class-1, ADR-014 sketch
annotated with publish_with_key_tx, ADR-015 status dated, reserved-
namespace kinds list normalized to six kinds, redrive gate wording
aligned, broken link fixed, StopToken deferral superseded in ADR-009.

docs/architecture/decisions/009-scheduler-collapse.md

@@ -81,9 +81,11 @@ store.run_schedules(stop) -> Result<()>        // runs until `stop`
   leadership ends the runner — the consumer's recipe is to respawn it
   (documented); the lock loss always precedes any stolen fire, so
   respawn never double-fires a boundary.
-- **Stop and return semantics**: `stop` is a cancellation token
-  (a cloneable handle whose flip ends the sleep early — the exact
-  type shapes at implementation, engine-crate docs). A leadership
+- **Stop and return semantics**: `stop` is a cancellation token — a
+  core-crate cloneable `StopToken` (pinned by
+  [ADR-019](019-mechanism-handle-surfaces.md) §4, 2026-10-06; the
+  original "exact type shapes at implementation" deferral is
+  superseded). A leadership
   loss returns `Err(LeadershipLost)` — a distinct, matchable outcome
   from the clean `Ok(())` a stop produces; the respawn recipe matches
   on it. (One taxonomy note: `LeadershipLost` is a *return-shape*