fix(divergence): scope claw latch to captured slot

The Greifarm entry restriction was still shared across both multiball slots.
An unrelated upper-playfield ball could clear the entering ball's latch during
its own record-89 scan, while a shallow aborted entry could retain a stale
choice. Store the latch owner with the capture-time restriction, permit only
that slot to clear it when leaving the deep capture zone, and migrate the owner
when a held secondary ball becomes primary.

Test Plan:
- `just --justfile tdkpin-rs/justfile test` -- passed (151 game, 8 service tests)
- `just --justfile tdkpin-rs/justfile clippy` -- passed
- `just --justfile tdkpin-rs/justfile build-production` -- passed
- `just --justfile tdkpin-rs/justfile web-build` -- passed
- `cargo +nightly fmt --manifest-path tdkpin-rs/Cargo.toml --all -- --check` -- passed
- `rumdl check --flavor commonmark tdkpin-rs/CHANGELOG.md tdkpin-rs/AGENTS.md` -- passed
- `git diff --cached --check` -- passed

tdkpin-rs/CHANGELOG.md

@@ -14,8 +14,9 @@ and this project adheres to
   latch the two-ball capture rule at each entry, exclude the launcher release
   while that capture is active, and let later single-ball re-entries use all
   four original release choices.
-- Preserve that entry decision through the complete pull phase and migrate the
-  Greifarm contact owner when a held secondary ball becomes the primary ball.
+- Preserve that entry decision through the complete pull phase, scope it to the
+  entering slot until that ball exits the capture zone, and migrate Greifarm
+  state when a held secondary ball becomes the primary ball.
 
 ## [1.2.0] - 2026-08-31