fix(cli): keep a live preview's ownership record and stop past a bad one

[miguel-heygen]

A missed liveness probe is not proof the preview is gone — a server blocked on a Puppeteer capture answers nothing for a second or two — but any miss retired the session record, and that record carries the only PID-reuse guard --stop has.

Reproduced

SIGSTOP a managed preview, then run preview --status. Before this change the record is deleted and never comes back, leaving every later stop to fall through to an unauthenticated port scan with no ownership proof at all. After it, the record survives and the preview is reachable again once resumed.

Only a wrapper process that is provably gone now retires a record. That record gains a process-birth token so a recycled PID reads as a different process, and it is written through a temp file and renamed — every reader deletes it when it fails to parse, so a torn read would otherwise destroy a live server's proof of ownership.

Two failure-propagation bugs in the stop path

• --kill-all collected the first unprovable record's exception and abandoned every server after it, so they were left running and unreported. Per-record failures are now collected and reported.
• A replacement refused to launch when the server it was replacing had already exited on its own — the goal state, treated as fatal, leaving the user to delete the session record by hand.

--list now shows managed sessions ahead of whatever else answers the scan, so the same server is not listed twice from its own self-report.

Stack

Based on u4a-process-kill-trust, whose OS-verified listener PID this relies on. Retarget to main before merging.