Review (ehz0ah): withSessionNotFoundResume retries stageForSession(recoveredId)
before it returns, so recording the stored→runtime binding in the caller's
onSessionRecovered came after the retry. The window's session-RPC dispatcher
routes a session-scoped call by translating its runtime id back to the stored
session and that session's owner; with no binding yet, an off-screen remote or
multi-profile retry was rejected as ownerless before the attach reached the
owning backend.
uploadComposerAttachment now hands an onRecovered callback to the resolver,
which fires before call(recoveredId); syncAttachmentsForSubmit publishes there
— the stored→runtime map and updateSessionState(recovered, …, stored), the same
publish the submit path does — and only then retargets the foreground when the
target is the foreground.
Tests: the dispatcher case pins that a freshly recovered runtime id fails closed
until its binding is published and routes to the session's owner after; the
queued-image case records what the dispatcher could see at the moment the
retried image.attach is issued and requires both bindings to be there already
(red on the previous head: central=false).
8cc4ff5d66