#4257 fix(limrun): recover when the Limrun instance ends under a held lease

Summary

Fix #4229: detect a terminated Limrun instance after its connection drops, report its cause, and retire its lease and sessions. Connected heartbeats make no API request; uncertain probes fail open within a two-second budget. Provider cleanup uses the existing persisted expiry retry path. The docs explain reinstalling before opening on a new instance.

The change touches 14 files. Scope includes daemon lease retirement, Limrun heartbeat detection, tests, and documentation.

Validation

• Head: 9e843bc448cd15539e4c01d16f5e89d5689a1d19; merge base: b42c7c265f0765045b1ce5c53dd426512e11108d.
• Focused recovery, provider, and eager-closure tests: 934 passed.
• pnpm check:affected --run --head 9e843bc448cd15539e4c01d16f5e89d5689a1d19: passed, exactCommit=true. GitHub-authoritative and manual replay lanes were skipped locally.
• Live Limrun iOS run at b31757ccfc passed (evidence in a PR comment): the instance was deleted under a held lease, the next command reported provider-instance-ended (UserRequested), the session ended, and open allocated a new instance. The inactivity-timeout end, a created Android instance, and an attached instance were not run live.
• Independent review found no new problems at 9e843bc.