Require cleanup before creating Effection-owned native resources

[taras]

Story

As a maintainer, I want an Effection-owned native resource to have its release
registered before the resource begins, so cancellation at the owner's first
suspension cannot strand a child process, socket, or server.

Example

An operation that launches a child first establishes teardown that can terminate
the child, wait for the child's own close event, and detach its handlers. Only
then does it call spawnChild(...). The same ordering applies to a connection or
server whose lifetime belongs to the operation.

Current gap

#748 requires this ordering in Code Rule 16, but
local/require-scope-bound-event-registration enforces only the listener half.
A new owner can assign spawnChild(...), connect(...), or createServer(...)
before yielding the ensure() that releases it and still pass lint. Focused
lifecycle regressions protect the owners migrated by #748, but they cannot
protect the next owner written in the same unsafe shape.

Contract

Reliably recognizable native-resource construction inside an Effection owner is
rejected when the matching release has not already been armed. The analysis is
binding-aware: it follows supported imports and repository wrappers rather than
diagnosing any function merely named connect, createServer, or spawnChild.

The accepted teardown shapes remain those established by Code Rule 16. Cleanup
is registered before construction, keeps required observers attached until the
resource's own closing event, and detaches them synchronously afterwards.
Resources with a genuine process-, browser-, or framework-owned lifetime remain
outside the rule.

Audit the existing lint targets when the rule lands. Correct applicable sites;
do not introduce a grandfathered baseline, directory exemption, or permanent
allowlist for repository-owned code.

Acceptance

• Lint rejects a child process, socket, and server constructed before the
  matching release is armed in an Effection-owned lifecycle.
• Direct, aliased, and namespace imports are recognized; shadowed or unrelated
  functions with the same names are accepted controls.
• Construction after valid teardown registration passes, as do native resources
  whose lifetime is demonstrably outside Effection.
• Moving one corrected resource constructor back ahead of its teardown fails
  focused evidence.
• Every applicable existing site is corrected or documented as a narrow,
  lifecycle-specific exception.

Relationship

This is the focused native-resource enforcement gap left on the record by #748.
It advances the broader ownership audit in #491 without replacing that story.

Out of scope

• Changing public process, networking, or server behavior.
• Treating name-only constructor matches as proof of ownership.