Subscription precision: lambda-handler tier (inline handlers, tiered by source lifetime)

[PhysShell]

Agent brief — tier: mid (above-average). One PR (Closes #<this>); branch from main. House rules: AGENTS.md.

Goal

From docs/notes/consolidation-and-positioning.md §"Genuinely next capabilities": finer subscription diagnostics for inline lambda handlers — a lambda += has no unsubscribe handle and typically captures this/local state — tiered by source lifetime exactly like the existing split (static source → OWN014 region escape; injected source → OWN001 advisory warning; bounded/local → silent).

Sources of truth

• The existing tiering machinery: frontend/roslyn/OwnSharp.Extractor/Program.cs (SubscriptionSourceKind, handler classification) and the bridge in ownlang/ownir.py (static→capture→OWN014 lowering, DI-graph escalation/refutation).
• docs/notes/subscription-leaks-and-profiles.md and docs/notes/closure-capture-escape-precision.md — recorded precision decisions; do not contradict them.
• docs/notes/field-notes-patterns.md — real-world shapes this should and should not flag.

Deliverable

• The lambda-handler dimension folded into the existing subscription facts (extractor) and verdict tiering (bridge/core), with fixtures: static-source lambda (escalates), injected-source lambda (warns), bounded/local-source lambda (silent), and a -=-impossible-but-bounded regression staying silent.

Guardrails

• Reuse the existing tier machinery — do not mint a new diagnostic code family unless the existing OWN001/OWN014 vocabulary genuinely cannot express it (if so, stop and record why in the PR).
• Precision-first: when the lambda's capture set or source lifetime is unprovable, the verdict degrades to warning/silence, never to a hard error.
• Extractor side is CI-validated only.

Done when

Fixtures pinned across all tiers, python tests/run_tests.py (incl. the OwnIR bridge checks) + ruff check . + mypy green, CI extractor jobs green.