Harden Detail Edit and Library session lifecycle

[OliverZhaohaibin]

Summary

Fifth replacement PR for #890. This isolates review findings 3, 4, and the active portion of 8 without importing Recognition/Pets or the broad #890 merge history.

• publish immutable Library binding epochs before synchronous session bind/unbind callbacks
• add PlaybackAsyncToken(library_epoch, asset_generation, asset_id, source_path, source_revision) and reject late still, metadata, location-search, location-write, and manual-face deliveries
• stop video, cancel presentation state, clear library-scoped surfaces, and invalidate transactions on a real session switch
• distinguish same-library treeUpdated refreshes from actual session changes
• block user-initiated library switches while Edit is active; Done commits and Escape cancels
• safely invalidate unexpected external switches without stale-handle exceptions or old-session writes
• share the current Detail still with Edit through a safely invalidatable render handle
• enforce a PlayerView-level 192 MiB CPU surface budget; retain only current/upload-fallback surfaces, include deferred stills in the same budget, and evict sessions instead of retaining every LOD
• refuse reusable render sessions when source revision is unstable
• add Linux/macOS/Windows Detail/Edit/Library lifecycle contracts

Validation

• focused lifecycle suite: 168 passed
• non-UI regression suite: 2328 passed, 13 skipped
• complete UI suite: 372 passed
• architecture checks, compile checks, workflow YAML, and git diff --check passed

Supersedes the Detail/Edit/Library lifecycle and CPU-retention portions of #890.