fix(runnerhub): ERRORED cleanup releases only the binding it saw (RIG-4742)

[rigel-mintaka]

This PR is part of a stack containing 2 PRs:

1. main
2. fix(runnerhub): ignore lifecycle frames that arrive after ERRORED (RIG-4452) #1774
3. "fix(runnerhub): ERRORED cleanup releases only the binding it saw (RIG-4742)" (this PR)

Summary

The ERRORED lost-session cleanup runs detached. Before this change, it unbound whatever row held the session id when it ran. A resume that re-bound the same session id in the same enrollment could therefore be unbound and archived by the old lifetime's cleanup. Implements RIG-4742 option A (binding lifetime token).

• Binding identity: each sessionBinding now carries:
  • version: a new session_bindings.binding_version column, set to a fresh UUID on every RecordSessionBinding upsert and returned by Record and Resolve. A UUID, not xmin, because transaction ids wrap around.
  • lifetime: a per-insert counter for the cache, which stores without a durable row rely on.
• Cleanup: the ERRORED path passes the binding it saw. dropLostSession skips if the current binding differs. releaseSession re-checks the cache before and after the durable delete.
• Conditional durable delete: a new DeleteSessionBindingVersion(ctx, sessionID, version) deletes only that write and reports whether it removed a row. If a peer Server re-bound the row, it removes nothing and the cleanup stops. A cached binding whose durable write failed has version "". It never deletes a row; if a row exists, the session was re-bound elsewhere, so the stale cache entry is dropped and no loss is reported. DeleteSessionBinding is unchanged and still serves Stop and the deliver-refusal loss.
• Stale reverse entry: when a cleanup finds its row re-bound, it drops both the stale session entry and the account entry that still names it.
• Reverse read-through: SessionForAccount now returns the row's version, so a binding cached from a delivery's reverse read carries it. Its ERRORED cleanup then deletes that row and reports the loss.
• Ordering with enroll (rebased onto fix(runnerhub): serialize enroll reaps with session promotion #1756): releaseSession takes bindingWriteMu like promoteSession, so a Stop's delete cannot land between an enroll's map-clear and its reap.
• Migration 0003_session_binding_version.sql: adds the column with a constant default (no table rewrite), then backfills existing rows with a UUID.
  • Renumbered to 0003 after main took 0002_forge_scopes.sql. Any open PR that lands first with a 0003 forces another renumber.

Internal token, no API change. This was decided by the compass lane on RIG-4742; Matt can overrule it there.

Verification

• Red→green regression tests. Each one fails on main's unconditional cleanup:
  • TestErroredCleanupKeepsSameEnrollmentRebind: pauses the old cleanup, re-promotes without re-enroll, releases. The cache and durable bindings survive and no loss is reported.
  • TestErroredCleanupKeepsRebindDuringDurableDelete: re-bind lands while the durable delete is paused. Fails if the delete is unconditional.
  • TestErroredCleanupKeepsPeerRebind: a peer re-binds the row; the cache is stale. Fails if a not-removed delete is ignored.
  • TestErroredCleanupWithoutDurableWriteKeepsPeerRow: the hub's durable write failed and a peer wrote the row. The row is kept, no loss is reported, and the peer's binding resolves. Fails if a version-less release ignores the competing row.
  • TestErroredCleanupWithoutDurableWriteKeepsLegacyRow: a version-less release meets a row with the default '' version. Fails if it calls the versioned delete.
  • TestErroredCleanupDropsStaleAccountForPeerRebind: a peer re-binds the session id to another account mid-cleanup. Fails if the old account still resolves to it.
  • TestErroredCleanupReleasesReverseReadThroughBinding: a binding learned by reverse read goes ERRORED. Fails if the read-through caches no version.
  • TestStopUnbindWaitsForEnrollReap: a Stop races an in-flight reap. Fails if the unbind does not wait for the enroll.
  • TestDeleteSessionBindingByVersionSkipsRebind (pgtest, real Postgres): a stale version deletes nothing and records no usage event; the current version deletes and ends its interval. Fails if the SQL condition or the end event is dropped.
• go test -race passes for ./server/, ./internal/runner/..., ./internal/runnerhub/ and ./internal/store/.
• pgtest suites for ./internal/store/, ./internal/runnerhub/ and ./server/ pass against local Postgres 17.
• golangci-lint reports 0 issues untagged, and nilaway is clean (the pre-push moon ci caught one nil-flow, fixed). With pgtest, none of its findings are in touched lines.
• squawk and sqruff pass on the migrations; sqlc generate output is committed.

Spec-impact: none (server-internal binding release; no API or documented state change).
Ledger-impact: none

[linear-code]

RIG-4742

[github-actions]

Compass engineering docs preview: https://compass-runner-4742-binding.compass-eng-docs.pages.dev

Deployed from compass-runner/4742-binding-lifetime-token at 260e55e.