Add policy-gated Calendar reservations

[mzored]

Outcome

The public assistant can offer safe meeting times and turn a trusted Telegram selection into one exact private Calendar block. The Calendar integration remains disabled by default and all authority stays inside the Policy Gate.

What changed

• add durable sender-bound Telegram offer controls and {offer_ref}-only schedule bindings
• create an ordinary owner-confirmation request when no current delegation permits the action
• enforce bounded delegation, monotonic read quotas, final free/busy recheck, deterministic event identity, and fixed private event content
• persist reservation intent before provider work and reconcile uncertain writes through the existing worker
• distinguish verified absence from a present mismatched event so uncertainty retains authority and erasure evidence
• validate exact least-privilege Google scopes and fixed OAuth endpoints without initializing credentials or network clients while disabled
• generate options in the configured IANA timezone, reject ambiguous/nonexistent or elapsed-duration-invalid DST intervals, and use buffers only for conflict checks
• add independent v4-to-v5 migration and recovery coverage

Verification

• poetry run pytest -q: 805 tests collected and passed
• focused Calendar/public/config acceptance: 19 passed
• affected public/Gate integration: 32 passed
• Black, isort, Flake8, targeted strict mypy, and git diff --check passed
• independent exact-head repair review: 9 focused cases passed with fake/injected providers

No live credential, Google Calendar, or production state was used or changed.