Durable afterCommit follow-ups (#1851 / #1906)

[michielbdejong]

Left over from the durable afterCommit implementation (#1851, draft PR #1906), all behind --plugin-after-commit:

• Uninstall or revoke: delete the app's afterCommit subscriptions (and the waiting proposals) when the app or Installation is uninstalled or revoked. Today they wait, like a paused installation.
• Losing read access: end a subscription as soon as the person who activated it loses read access to the table. Today it ends at the next delivery attempt.
• Stale proposals after a release change: refuse or discard a proposal that's waiting for review when the app's release changes. Today it's applied as reviewed.
• Playwright spec (outside @smoke): add the view with Allow editing, edit a row in another tab, and check the hook's write lands; then the Read-only path produces a review bar.
• Race test: a person's edit arriving just before the hook's write to the same row.

[michielbdejong]

Picking up the server-side items (atomic-server worker, cloud session), on claude/after-commit-followups, stacked on #1906:

• end subscriptions (and drop waiting proposals) when the Installation is revoked or uninstalled, or the app is gone;
• end them promptly when the activator loses read: a store-event listener re-checks the affected subscriptions, plus the 10-minute sweep as the backstop;
• a proposal waiting for review is discarded when the app's source changes, and the page is re-run with the new code;
• the race test (a person's edit just before the hook's write).

The Playwright spec comes after, separately.

---

Generated by Claude Code