fix: prune runtime binding owner tombstones when panes close

[shuv1337]

refs #19

runtime_binding_owners entries (bound or unbound) are retained exactly as long as their public pane ID resolves to a live pane. No timers, no count cap.

Behavior change to review

This gives up the #16 guarantee tested by native_runtime_attachment_closed_owner_reserves_identity_after_empty_restart (renamed to ..._closed_owner_is_released_after_empty_restart): a binding whose pane was closed could never be bound again (runtime_binding_conflict) and its workspace public ID stayed reserved after an empty restart. Keeping both would mean remembering every binding forever, which is the growth #19 is about. After this change, an empty restart can hand out a workspace ID a closed owner used before; a stale client could bind a new pane under its old binding_id, but it starts with seq: null and no carried entry. If that reservation should be preserved, the alternative is persisting a single next-workspace-ID floor instead of per-binding tombstones.

Change

• src/app/actions.rs: AppState::runtime_binding_owner_is_live and AppState::prune_runtime_binding_owners, run at the end of remove_unattached_terminal_ids (shared cleanup for pane/tab/workspace close, pane death, layout replacement). Pane moves re-point entries rather than drop them.
• pane.unbind_runtime: keeps the entry for the pane being unbound (seq continuity), prunes entries for panes that no longer exist, schedules a save if anything was pruned.
• Restore and handoff (src/app/mod.rs): prune after restore without marking the session dirty, so a failed empty restore cannot trigger Clear.
• assert_invariants_for_test: every owner entry points to a live pane.
• capture_session_save_job can return Clear again once the last pane closes.
• restore.rs still reserves IDs for owners in older session files or panes that fail to restore.

Tests

runtime_attachment_owner_is_pruned_when_owning_pane_closes, runtime_attachment_unbind_prunes_owners_of_missing_panes, session_save_clears_after_last_runtime_binding_owner_pane_closes, restore_keeps_live_runtime_binding_owners_and_reserves_their_identity; runtime_attachment_identity_sequences_and_unbind_preserve_topology unchanged and passing.

Validation

cargo fmt, cargo clippy --all-targets --locked -- -D warnings, cargo nextest run --locked --no-fail-fast (3834 passed, 8 skipped). One unrelated flake on the first just ci-tests run (agent_start_rejects_a_shell_replaced_by_a_foreground_program returned timeout; passed 3/3 alone). just check not run locally (Windows cross-lint not set up); CI covers it.