fix(web): keep removal-time availability invalidation across an in-flight pull

The `host/session-removed` invalidation flipped the owned catalog and
addressed children to `parentAvailable:false`, but a `subagent.list` pull
already in flight was requested before the removal and its ok-response
carries the pre-removal `parentAvailable:true` — the response then
overwrote both the catalog and every addressed child, resurrecting the
writable-editor-against-a-dead-continuation-owner bug the invalidation
closes, with no refresh scheduled to converge afterwards.

Mark the owner stale when a pull is in flight at removal time, so one
trailing refresh runs after the in-flight response settles and the
post-removal host truth lands. Adds a regression test: removal mid-pull,
stale ok response, trailing pull, final state stays unavailable on the
catalog and the addressed child.

packages/client/runtime/src/client/sessions/manager.ts

@@ -688,6 +688,11 @@ export class SessionManager {
         this.pendingBuffers.delete(frame.sessionId) // a removed session's buffered frames must not replay on a future instantiation
         this.waitingApprovals.delete(frame.sessionId) // a removed session cannot wait on anyone
         if (!durableSubagent) this.projectionStores.delete(frame.sessionId)
+        // A pull already in flight was requested before this removal and can
+        // carry the pre-removal parentAvailable:true, which would resurrect
+        // the writable editor this invalidation just closed. Queue one
+        // trailing refresh so the post-removal host truth converges.
+        if (this.catalogInflight.has(frame.sessionId)) this.catalogStale.add(frame.sessionId)
         // The removed session can no longer be the delivery owner of its
         // catalog: invalidate availability immediately. Removal schedules no
         // catalog refresh, and without this an addressed child keeps a