feat(fm): remove a federated instance at the partner when SRM hands over a terminate (ADR-0053)

FM now takes command.fm.service.terminate. It finds the outbound
install-app transaction SRM's service_instance_id was recorded on, calls
OPG.04 RemoveApp with the partner-issued appInstIdentifier, records a
remove-app transaction keyed on the operation_id, and publishes
event.fm.operation.completed (operation=terminate):

- 200 -> completed, completion_basis partner_accepted
- 404 -> completed, completion_basis partner_not_found (already gone)
- other answers or an unreachable partner -> failed
- no matching install -> failed, instance-not-federated

A redelivered command sends no second RemoveApp and publishes the stored
outcome again, since a failed publish is what leaves it unacked.

Commands now reach FM through one fm-task-worker durable on
command.fm.>,
dispatched by subject. Subscribing each command separately on that
shared
durable bound to its old deploy-only filter: terminates never arrived
and
deploys could land in the wrong handler. A durable an older FM left with
the narrow filter is dropped and recreated; unacked commands stay in the
work-queue stream.