TUI/Desktop sessions that end via _finalize_session never cleared the
approval session state, so session-persistent execute_code kernels
(owner = approval session key) stayed alive until the NEXT execute_code
in the same process ran the lazy idle sweep in _acquire_kernel.
The gateway's /stop and /new paths already call approval.clear_session
(approval.py:264) at the same boundary, killing the owner's kernels with
the session. Align the TUI path: when the TUI owns the session lifecycle
(not a viewer tab over a gateway-owned session), clear_session(session_key)
on finalize so a finished conversation cannot leak a live interpreter.
Fixes the class: any end_reason that tears down a TUI-owned session
(tui_close, ws_orphan_reap, idle_timeout, lru_evict, tui_shutdown) now
reaps its kernels.
7fa45eb349