fix(backend): robustness pass — spawn leak, timeouts, workspace fail-loud, 409 order, respond guard

Audit findings 4.1-4.6.

- spawnFor: a rejected configure/start no longer leaks a registered runtime
  with a live Pi child (identity-checked teardown + rethrow); every later
  start used to hit "session runtime already active".
- ThtRunner.run: default 60s timeout on every tht child (SIGKILL backstop),
  120s for DWH-touching calls (sql preview/export, search pack); a dropped
  VPN mid-call no longer wedges the HTTP request forever.
- configArg: a NAMED workspace whose yaml is missing now throws instead of
  silently falling back to the default config (operations were silently
  targeting the wrong workspace).
- resume: the finalized/archived 409 is evaluated BEFORE the alreadyActive
  fast-path — the manifest is the truth even with a lingering runtime.
- ollamaEnsure: exit-0 with non-JSON stdout is a failed check, not ok:true.
- SessionBridge.respond: only the response matching the pending descriptor
  is forwarded to Pi; stale/duplicate submissions return 409 instead of
  being sent with the current gate's RPC id.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

backend/src/routes/sessions.ts

@@ -246,7 +246,9 @@ export function sessionRoutes(
     } catch { return storageFailure(reply); }
     const rt = d.mgr.get(id);
     if (!rt) return reply.code(404).send({ error: "sessione non attiva" });
-    rt.bridge.respond((req.body as any).ui_response);
+    if (!rt.bridge.respond((req.body as any).ui_response)) {
+      return reply.code(409).send({ error: "risposta non corrispondente al gate in attesa" });
+    }
     return reply.code(204).send();
   });
   app.post("/sessions/:id/steer", async (req, reply) => {
@@ -273,6 +275,11 @@ export function sessionRoutes(
       } catch { return storageFailure(reply); }
       if (!manifest) return reply.code(404).send({ error: "session not found" });
       const runner = runnerFor(principal);
+      // Read-only contract FIRST: a finalized/archived session must refuse resume even
+      // when a lingering runtime still looks active — the manifest is the truth.
+      if (manifest?.status === "finalized" || manifest?.archived) {
+        return reply.code(409).send({ error: "sessione in sola lettura (finalizzata o archiviata)" });
+      }
       // This check belongs inside the per-session lock: a preceding cold Resume may have
       // installed a running runtime while this request was waiting.
       const existing = d.mgr.get(id);
@@ -282,9 +289,6 @@ export function sessionRoutes(
           return reply.code(200).send({ id, alreadyActive: true });
         }
       }
-      if (manifest?.status === "finalized" || manifest?.archived) {
-        return reply.code(409).send({ error: "sessione in sola lettura (finalizzata o archiviata)" });
-      }
       const ensure = await d.readiness.ensure(settings.workspace ?? "", principal);
       if (!ensure.ok) return reply.code(503).send({ error: READINESS_FAILURE_MESSAGE });
       const saved = manifest as { provider?: string; model?: string; thinking?: string } | null;