fix(bridge): durable streams + decouple job from connection + single-instance guard

[drewstone]

Durable streams + decouple job from connection + single-instance guard

Fixes the three cli-bridge faults that let a dropped connection or a stray restart kill a live agent run.

• Single-instance guard — a second launch on the same BRIDGE_PORT exits cleanly instead of racing the bind and severing the running instance's streams. The systemd unit is unaffected.
• Job decoupled from the connection — a client disconnect no longer aborts the run and kills the CLI subprocess; the job keeps running so the client can reconnect. The subprocess is killed only on an explicit cancel.
• Durable streams — per-session events are buffered server-side and replayed on reconnect via Last-Event-ID, with idempotent dispatch by run id so a retry re-attaches to the same run instead of cold-starting.

Verification

A second instance on the same port exits cleanly; a client disconnect leaves the subprocess running; a reconnect with Last-Event-ID replays missed events; a retry re-attaches.

Relationship to the shared package

cli-bridge is the local mirror of the production sandbox API; its run buffer re-points onto the shared EventStreamStore from @tangle-network/sdk-core/durability once that package publishes, so local and production share one durable-stream contract.