core: claim a store-listed transaction only on the device that bought it

A store account's purchases are listed on every device signed into it:
Play's purchase query lists active subscriptions for their whole life, and
Apple's Transaction.updates delivers auto-renewables made on other devices.
A hand-over with no record and an unknown echoed invoice made a new record
under the presenting profile, so another device could claim a buyer's
subscription for its own active profile, or repeat a refused request every
30 days after cleanup.

/_badge purchase now takes a `listed` mark, which the apps' sweeps and
purchase listeners send: it joins only a record this core already has for
the transaction or its echoed invoice, and otherwise records and sends
nothing (CRStoreReceiptNotRecorded). The purchase call and Restore hand over
unmarked, as before.

Run: 003-badge-subscriptions-ui, slice 4

bots/src/API/Docs/Responses.hs

@@ -208,6 +208,7 @@ undocumentedResponses =
     "CRSndStandaloneFileCreated",
     "CRSQLResult",
     "CRStandaloneFileInfo",
+    "CRStoreReceiptNotRecorded",
     "CRTagsUpdated",
     "CRUsageConditions",
     "CRUserPrivacy",