fix(tmux,run,hooks): the four pre-existing bugs the #37 evaluation found

- tmux targets are exact (`=name`, `=name:` for panes/options): a bare
  `-t agenthub-lane-1` resolves by prefix to agenthub-lane-12 once lane 1
  is gone, so killing a finished lane could kill another.
- getRun/killRun refuse ids that are not `agenthub-lane-<n>`, so
  DELETE /api/run/main can no longer kill a user's own tmux session.
- router/apply reports restart_required only for a running pane; getRun
  returns a `gone` handle, so it was always true.
- needs_action is cleared only by the session that raised it (new nullable
  lanes.needs_action_session); a second session in the same cwd used to
  clear it on its second hook.

server/db.js

@@ -695,6 +695,17 @@ try {
 }
 db.prepare("CREATE UNIQUE INDEX IF NOT EXISTS idx_lanes_cwd_tool ON lanes(cwd, tool)").run();
 
+// Migrate: which session raised `needs_action`. Two sessions in one lane's cwd
+// (a hand-started terminal beside the dashboard pane) rebind `session_id` on
+// every hook, so "the bound session" is not "the session that is waiting".
+// Additive and nullable; null (a flag raised before this column) falls back to
+// the bound session. Placed after the rebuild above, which lists its columns.
+try {
+  db.prepare("SELECT needs_action_session FROM lanes LIMIT 1").get();
+} catch {
+  db.prepare("ALTER TABLE lanes ADD COLUMN needs_action_session TEXT").run();
+}
+
 // Seed lane_stage_events from the snapshots that predate it, so upgrading does
 // not read as "every pipeline has never run". Each lane's live `stages` blob
 // becomes one run; each archived feature becomes one more. That is all the