Use ephemeral guest access

Replaces persisted guest participants with proof-bound ephemeral access leases, validates guest operations against current lease state, and reconciles missed or expired guest attempts.