Qualify published SDK external completions during draining

[rmcdaniel]

Summary

• Update the existing storage-admission SDK fixture to published PHP 2.0.9, Python 2.0.4, and Rust 2.0.5.
• Verify that three already-leased external activity completions drain while new starts and unbound external uploads remain rejected.
• Retain hard-fence no-write checks, original attempt identities, one handler execution per SDK, and fresh-process recovery verification.

Verification

• Ran the corrected fixture against the unmodified published Server 2.3.6 image (sha256:5dca1be828839f73557b21b46c8a8226f9ebe2665d5c671c75f55f10d84155a2).
• All three SDK completions drained; 262,144 decoded payload bytes each, three handlers executed once.
• Stopped SDK workers, restarted MySQL and Server, then experiment recover verified results in a fresh process.
• Required PR checks pass.

The first fixture attempt incorrectly used JSON for the Avro external-upload endpoint and received 415. The fixture was corrected to send Avro bytes with the required metadata, then rerun from a fresh database. This was a fixture error, not a product defect.

Part of #146. This PR changes reproducible tests only; it does not require another Server release.