fix: reject conflicting stable session runtimes

[dataforxyz]

Summary

Port the stable-session collision guard from dataforxyz/agent-intercom-pi#9 to the OpenCode broker copy.

• reject a second live local runtime claiming an active stable session ID with SESSION_ID_IN_USE
• preserve same-runtime reconnects using optional runtimeInstanceId, with legacy pid + startedAt fallback
• keep the incumbent socket and pending deliveries intact
• prevent superseded sockets from applying stale ask deferrals
• rebuild the packaged broker artifacts

Validation

• npm test — 72 passed, 0 failed
• npm run typecheck
• npm run build
• git diff --check
• focused collision tests cover token-aware conflicts, legacy compatibility, pending-delivery preservation, private runtime identity, and legitimate reconnect replacement