fix(tmux,run,hooks): the four pre-existing bugs the #37 evaluation found

- tmux targets are exact (`=name`, `=name:` for panes/options): a bare
  `-t agenthub-lane-1` resolves by prefix to agenthub-lane-12 once lane 1
  is gone, so killing a finished lane could kill another.
- getRun/killRun refuse ids that are not `agenthub-lane-<n>`, so
  DELETE /api/run/main can no longer kill a user's own tmux session.
- router/apply reports restart_required only for a running pane; getRun
  returns a `gone` handle, so it was always true.
- needs_action is cleared only by the session that raised it (new nullable
  lanes.needs_action_session); a second session in the same cwd used to
  clear it on its second hook.

server/routes/hooks.js

@@ -210,10 +210,18 @@ function touchLaneFromHook(hookType, data) {
     if (data.session_id && lane.session_id !== data.session_id) patch.session_id = data.session_id;
     if (hookType === "Notification" && !idleNudge) {
       patch.needs_action = data.message || "needs you";
-    } else if (lane.needs_action && data.session_id === lane.session_id) {
-      // Clear only when the hook comes from the session currently bound to the lane
-      // (evaluated before any rebinding, so a rebinding hook never clears in the same pass)
+      patch.needs_action_session = data.session_id || null;
+    } else if (
+      lane.needs_action &&
+      data.session_id &&
+      data.session_id === (lane.needs_action_session || lane.session_id)
+    ) {
+      // Clear only from the session that raised it: another session sharing the
+      // cwd rebinds session_id on every hook but is not the one waiting. A flag
+      // with no recorded raiser falls back to the bound session (evaluated
+      // before any rebinding, so a rebinding hook never clears in the same pass).
       patch.needs_action = null;
+      patch.needs_action_session = null;
     }
 
     // Only idle↔running is mirrored: provisioning and failed are lifecycle