fix(tmux,run,hooks): the four pre-existing bugs the #37 evaluation found

- tmux targets are exact (`=name`, `=name:` for panes/options): a bare
  `-t agenthub-lane-1` resolves by prefix to agenthub-lane-12 once lane 1
  is gone, so killing a finished lane could kill another.
- getRun/killRun refuse ids that are not `agenthub-lane-<n>`, so
  DELETE /api/run/main can no longer kill a user's own tmux session.
- router/apply reports restart_required only for a running pane; getRun
  returns a `gone` handle, so it was always true.
- needs_action is cleared only by the session that raised it (new nullable
  lanes.needs_action_session); a second session in the same cwd used to
  clear it on its second hook.

server/__tests__/pty-run.test.js

@@ -241,7 +241,18 @@ describe("pty-run", () => {
       return "";
     });
     assert.equal(pty.killRun("agenthub-lane-5"), true);
-    assert.ok(calls.some((c) => c[0] === "kill-session" && c[2] === "agenthub-lane-5"));
+    assert.ok(calls.some((c) => c[0] === "kill-session" && c[2] === "=agenthub-lane-5"));
+  });
+
+  it("never touches a tmux session that is not a lane pane", () => {
+    const calls = [];
+    tmux.__setExecImpl((args) => {
+      calls.push(args);
+      return "";
+    });
+    assert.equal(pty.killRun("main"), false);
+    assert.equal(pty.getRun("main"), null);
+    assert.deepEqual(calls, []);
   });
 
   it("listRuns reflects live tmux-session state, not cached memory", () => {