fix: suppress late session updates after close

[ignatov]

Summary

• prevent delayed available command discovery from publishing to a closed session
• validate session identity, generation, and closing state before publication
• add a regression test for session/close racing with listSkills

Root cause

session/new starts available command discovery asynchronously. If session/close completes before listSkills returns, the delayed available_commands_update targets a session the ACP client has already removed.

Testing

• npm run typecheck
• npm test (438 passed, 28 skipped)
• npm run bundle:all
• npm run codex-test -- -p "Reply with exactly OK." -o summary