fix: harden plugin shutdown and cold-pass isolation

[kernel-oops]

Summary

• implement OpenCode's supported asynchronous dispose hook and declare engines.opencode >=1.15.11
• quiesce cold-pass, incremental, timer, and persistence work before bounded shutdown and SQLite close
• make summarizer worker cleanup safe across writer-lease handoff using unique ownership and authoritative lease rechecks
• quarantine malformed sessions by sessionID + timeUpdated so one bad historical row cannot abort and retry the entire cold pass
• preserve valid recall data across transient metadata transport failures and retry it on later activity

Why

A plugin instance currently owns timers, SQLite state, background distillation, and summarizer workers without exposing lifecycle disposal. When OpenCode disposes a per-directory plugin instance, those resources can remain alive. Separately, one legacy session with an obsolete response shape can abort the complete cold pass; the global retry then scans thousands of healthy sessions again roughly once per minute.

Verification

• formatting and ESLint pass
• source and test TypeScript checks pass
• ESM build and declaration generation pass
• Vitest: 384 passed, 7 skipped (21 files passed, 2 skipped)
• focused disposal, lease-handoff, malformed-session, and metadata retry race tests pass repeatedly

Residual constraints

• the OpenCode SDK does not expose cancellation for already-started requests; shutdown prevents late SQLite work but may wait for an in-flight non-summarizer request
• a create request that outlives the bounded shutdown window may leave a uniquely owner-tagged remote worker for a later lease holder to remove
• quarantined revisions are kept in bounded in-memory state and are retried after plugin restart
• orphan discovery remains bounded to the existing session-list page size