Make session bootstrap and recovery atomic across reloads and restarts

[Juliusolsson05]

Problem

Renderer reload and full application restart currently share a fragmented session bootstrap path. Rehydrate can bypass main-owned adoption, allocate new local ids, duplicate provider processes and scoped MCP credentials, drop panes after startup failure, and mark input ready before provider replay actually quiesces.

Required shape

Keep SessionManager. Add one atomic main-owned recoverSession operation keyed by the persisted local SessionId.

• Renderer reload adopts an existing backend without new provider, proxy, or MCP side effects.
• Full restart spawns exactly once under the persisted local id and forwards durable provider resume hints.
• Concurrent recovery joins one synchronous main-owned claim.
• Kill during startup cannot leak or resurrect a backend.
• Failed panes and drafts remain visible and retryable.
• Autosave resumes after every pane has a resolved outcome, including retained failures.
• Composer readiness is provider-attested, level-triggered, versioned, and transported through SessionFeed.
• Add deterministic fake-provider, fake-MCP, renderer, and cross-layer restart tests for Claude, Codex, opencode, and terminal sessions.

Scope guard

Do not rename SessionManager, add a state-machine framework, or combine the correctness change with unrelated file moves. Provider-specific durable identity acceptance can follow after atomic ownership and readiness are green.

[Juliusolsson05]

Implementation is now underway in draft PR #548. The reviewed plan is included in that PR, and the first atomic SessionManager recovery slice is green.