fix: acknowledge maintenance outputs after publication

[zzylol]

Maintenance DAG outputs were marked published before the downstream store accepted them. If the store failed, retrying the same lineage silently skipped its state.

Before this PR, a temporary store failure followed by replay could produce zero accepted outputs. After this PR, each maintained output is acknowledged only after the store accepts it; retry skips accepted outputs and resends failed ones. A registry lock makes the acceptance/acknowledgement boundary exclusive across concurrent retries. Unmaintained batches keep the ordinary batched sink path.

Verification: the new installed-DAG/fail-once-sink regression failed on the original implementation (zero accepted outputs instead of one). All three maintenance runtime tests pass after the fix, including failure before any acceptance and failure after the first output in a two-output batch. Direct rustfmt and git diff --check pass.

Scope: this preserves in-process retry idempotency. Durable restart recovery and bounded commit-registry retention remain separate work. Maintained outputs are submitted individually because the generic sink does not return per-output batch acceptance; a sink that accepts a write and then reports failure still needs its own idempotent storage contract. No throughput improvement is claimed.