Remove the reconciler's background session stops (rest-stop and stop-on-finalise)

[MJohnson459]

Reconciliation ran two background stops: the rest-stop released any session on a
needs-input/review/waiting task whose listing entry read done, and
stop_finalised retired the registry entry of every session a pass finalised.
Both fired unprompted, at whatever the pass found, on every read of the store —
which is every TUI refresh and every CLI verb.

At the operator's desk that reaches into sessions nobody asked about: the
separate Claude window flickers, moves and gets reset even when the task being
reconciled is not the one in focus, and a stop landing in a live session is a
plausible source of prompt-cache churn. Both call sites go, along with
rest_stop, stop_finalised and the now-unused imports. Every stop Voro makes
now hangs off something the operator just did: a closing verdict (Accept,
Abort, Abandon, via stop_closed_session in cli.rs/app.rs) or the send
that needs the hold released.

The quick-message path already released a held session inline and waited on,
because the operator could outrun a reconcile tick. That inline release is now
the only one, and it covers the same ground: the rest test — task at rest,
listing entry reads done — is read on the keypress that needs the hold gone
rather than swept in the background. The invariant that a message only ever
reaches a session that has explicitly handed back is unchanged: mid-turn the
liveness gate refuses the send, between turns the send releases the hold itself
and refuses outright if that release fails. The capped-session sweep's
unconditional release is untouched, as are the reconciler's read-only probes
(sessions listings, logs cap readings).

The accepted cost is what Voro did before it stopped anything: a session
reconciliation finalises keeps its entry in the agent's own listing until the
verdict that closes the task, and a handed-back session keeps its entry until
the first message into it. That is a lingering listing entry and nothing broken
— the same degradation an agent defining no stop verb has always had — and
the operator's close still clears the common case.

DESIGN.md §8 moves with the code: the in-place-resume paragraph, the rest rule
(now stated as happening on the send, with a new paragraph recording why no
sweep makes it), the delivery invariant, the recorded trade (which now runs the
other way), and which closes stop. Doc comments in dispatch.rs,
session_probe.rs, app.rs and voro-core's agent.rs that named the
reconciler as a stop caller are updated to name the send path instead.

Verified: cargo test --workspace — 916 pass, 0 fail; cargo clippy --workspace --all-targets -- -D warnings clean; cargo fmt --all --check clean. The
reconcile tests that pinned the removed behaviour are replaced by ones pinning
its absence — a_finalised_dead_session_is_not_stopped and
a_healed_stale_session_is_not_stopped (the row closes, the marker the stop
verb would write never appears) and a_session_at_rest_is_left_registered
(all three rest states, with the store's events and the session's ref asserted
unmoved). The send-path tests still pass unchanged:
a_send_releases_a_session_the_agent_still_holds_at_rest,
a_send_makes_no_stop_when_the_session_is_not_listed_at_rest and
a_failed_release_refuses_the_send_and_commits_nothing.