Module forwarders: check-then-call races a live retirement (leased try-current-service) #6715

Follow-up from the review of #6680 (Refs #6680, thread #6680 (comment)).

ModuleServiceForwarders answers "is this module generation still current?" and the caller (NodeTypeAccessRuleSet) then calls NodeType/SupportedOperations on the proxy. ModuleContexts.Retire can remove the generation and dispose its services between the two, so a write concurrent with an uninstall can fail with Module … holds no service scope. ModuleContexts.cs already documents this check-then-resolve window for forwarders in general.

Direction: an atomic, leased "try current service" operation on the forwarder, used for rule metadata and evaluation instead of a boolean check followed by a proxy call.

Not established: a reproduction. #6680 does not widen the window; it fixes a withdrawn module's rule staying in the set.