fix(core): harden orchestrator routing and enforcement hooks

[windoliver]

Summary

• prevent cross-session contribution forwarding in SessionOrchestrator by using a per-role session-id allowlist instead of role-only fallback matching
• harden orchestrator lifecycle handling by cleaning poll timers/handlers on stop and making waitForCompletion timeout reliably even when idle checks throw
• ensure EnforcingContributionStore pre-write hooks are always cleaned up on failed enforcement/write paths, and optimize retry-after calculation to a single-pass scan
• add regression coverage for resumed-session polling, post-stop event handling, timeout-on-errors, and hook lifecycle edge cases

Test plan

• bunx biome check src/core/session-orchestrator.ts src/core/session-orchestrator.test.ts src/core/enforcing-store.ts src/core/enforcing-store.test.ts
• bun run typecheck
• bun test src/core/session-orchestrator.test.ts src/core/enforcing-store.test.ts
• bun test src/core (tests pass; repo coverage gate can return non-zero)

Made with Cursor