[xiangfu0]

Native broker routing images need finite serving authority before they can back query execution. This adds an explicit serving lifecycle that commits readiness, consumes exact renewal outcomes, and waits for a coherent post-renewal membership view before accepting work. Unknown outcomes keep the original request and first-send time.

Each admission retains the captured plan, exact server requests, original query deadline, broker permit ticket and selected-server lease bounds. Local delivery checks are isolated from membership RPCs and serialized with revocation. Route or authority changes cannot revive old attempts; drain preserves only their original finite lifetime, and shutdown fences before waiting for unregister.

Stacked on #19967. Keep this PR and all ancestors draft. Helix/ZK remains the default. Normal native starters still use the membership-only constructor and keep query listeners disabled. Authenticated query entry, network dispatch, final HTTP delivery fencing, quotas and production clock qualification remain required before activation.

Validation:

• 35 focused local cases pass: 16 clock/permit guard cases, 12 broker participant cases, 5 routing-image cases and 2 normal-starter cases.
• Tests cover blocked RPCs, post-renewal read failures, exact replay, finite broker/server bounds, drain, endpoint changes, revocation/recovery and prompt shutdown fencing. Starter coverage retains ZK-free startup, minion output installation and closed query ports.
• Affected-module formatting, Checkstyle and license checks pass. Warning-enabled compilation has no warnings on added lines; git diff --check passes.

Synthetic test clocks establish protocol behavior only; no production clock qualification or end-to-end native query-serving claim is made.