The new escrow package reaches the hub only when its code is claimed (R-978, unreleased)

The root ceremony uploaded the new package before the new code was claimed, and the hub
overwrites the current package when the sealed secrets are unchanged: a customer who started the
ceremony again and walked away kept a written-down code that opened nothing. Json mode (the
FELHOM_ESCROW argv, unchanged) now returns the package (CeremonyOutput v2, PendingUpload); the
daemon uploads it at POST /escrow/ceremony/claim before handing out the code. A failed upload is a
502 with the code still claimable; TTL and a new start wait for an in-flight claim upload; no
uploader is a 503. Text mode still uploads at once. No sudoers change.
Tests TestEscrowCeremony_R978_* (localapi) and the cmd-side defer/delivery/wiring tests, red-proved.

internal/localapi/server.go

@@ -426,6 +426,8 @@ type Server struct {
 	escrowMu       sync.Mutex
 	escrowJob      *escrowCeremonyJob
 	escrowR        []byte
+	escrowPending  []byte // R-978: the ceremony's hub upload body, sent by the claim before R is handed out
+	escrowClaiming bool   // R-978: a claim is uploading escrowPending (TTL and a new start wait)
 	escrowRClaimed bool
 	escrowRExpiry  time.Time
 	escrowDone     <-chan struct{} // closes when the detached job finishes (tests wait on it)