Release Server 2.5.1 with worker-session correctness fixes

[rmcdaniel]

Prepares Server 2.5.1 and Helm chart 0.1.138 for the worker-session correctness fixes discovered under durable-workflow/.github#124.

• Consume published Native 2.4.1 through the exact Composer lock identity so session routing survives cold replay.
• Include merged Preserve absolute worker-session TTL after holder loss #302, preserving the original absolute session TTL after lease loss and reacquisition. TTL remains terminal even after a lease was already marked expired.
• Generate current deployment and chart versions from the release manifest.

Session resources remain process-local and must be rebuilt after holder loss. Existing histories are preserved, and missing session metadata from older history is not reconstructed. No Cloud rollout is included.

Release qualification requires the complete normal Server checks, both published image architectures, published protocol and lifecycle conformance, and SDK consumers of the exact new image.

[rmcdaniel]

The runtime prerequisites are published in Workflow 2.4.1 / Server 2.5.1. Server publication passes both architectures, first-run readiness, published Compose, protocol catalog convergence and matching Helm installation.

Exact image: ghcr.io/durable-workflow/server@sha256:aa604d4c97219e96a4d66626f875ab119d624cb0d5c072513ec11690c2f87f43. It contains Native 3d498ee6910e4e482bd1a29c9e07a6e4b3de5a46 and Server ab64f990ee7173246269b93505e0ea9386e893ad.

Against that published image, source-free PHP SDK 2.2.0 passes typed lifecycle, duplicate close, original TTL after holder loss and cold replay by a fresh Worker instance. Source-free Python SDK 2.4.0 passes all three existing session integration cases. Rust candidate 3.2.0-rc.1 at 5b92cf6c2a64d21863225201fbf09f70c6e5cfb5 passes all six actual session cases in 31.43 seconds, including physical SIGKILL, natural attempt recovery, resource rebuilding and stale completion refusal. This Rust result uses candidate source.

Commands are python -m pytest tests/integration/test_worker_session.py -v, a standalone PHP Composer consumer of durable-workflow/sdk:2.2.0, and cargo test --test worker_session_server -- --ignored --nocapture --test-threads=1, using an isolated MySQL/Redis stack and the exact image above.

Next: complete the hosted candidate qualification, publish the Rust prerelease, qualify a fresh installed crate, then finish stable publication and customer documentation under sdk-rust#66. Session resources remain process-local and must be rebuilt after holder loss.