收口七月卡状态回调与系列授权兼容契约

完成运营商实名回调、业务事件观测序列与受控配置装配，同时恢复 UR43 已交付的 packages[].remove 字段及旧响应兼容，统一更新 OpenSpec、OpenAPI 和交付文档。

Constraint: 七月测试环境里程碑不新增或运行自动化测试

Rejected: 以必填 operation_type 替换 packages[].remove | 会破坏已交付前端契约

Confidence: high

Scope-risk: broad

Directive: 后续修改系列套餐管理接口必须保持 packages[].remove 和 ShopSeriesGrantResponse 兼容

Tested: go run ./cmd/gendocs；go build -buildvcs=false ./...；openspec validate complete-july-iteration-test-release --strict；git diff --check

Not-tested: 按本 Change 约定未运行 go test，真实运营商与 Gateway 联调延期

internal/task/polling_carddata_handler.go

@@ -42,12 +42,12 @@ func (h *PollingCarddataHandler) Handle(ctx context.Context, task *asynq.Task) e
 		return h.base.requeueCard(ctx, cardID, constants.TaskTypePollingCarddata)
 	}
 	defer h.base.releaseConcurrency(ctx, constants.TaskTypePollingCarddata)
-	locked, err := h.base.acquireCardTrafficSyncLock(ctx, cardID)
+	lockToken, locked, err := h.base.acquireCardTrafficSyncLock(ctx, cardID)
 	if err != nil || !locked {
 		h.base.logger.Warn("卡流量同步锁不可用，延迟重入队", zap.Uint("card_id", cardID), zap.Error(err))
 		return h.base.queueMgr.Requeue(ctx, cardID, constants.TaskTypePollingCarddata, time.Now().Add(5*time.Second))
 	}
-	defer h.base.releaseCardTrafficSyncLock(ctx, cardID)
+	defer h.base.releaseCardTrafficSyncLock(ctx, cardID, lockToken)
 
 	h.base.invalidateCardCache(ctx, cardID)
 	card, err := h.base.iotCardStore.GetByID(ctx, cardID)