Survive a crash, and a reboot after one

kill, a closed window, a reboot: no SessionEnd arrives and the state file
stays. Each case was tried rather than reasoned about, and one of the
three was broken.

A killed session was already handled -- the process is gone, so the file
and its lock are removed within the 20 s liveness tick. An interrupted
hook write left its temporary file behind forever; those are now swept
once they are five minutes old, which is late enough that a hook part-way
through writing one does not lose the update.

The reboot case was the broken one. State files outlive a reboot and pids
are handed out afresh, so "does /proc/<pid> exist" only answers "is some
process wearing that number". Verified by giving an unrelated live process
the pid of a dead session: the ghost sat in the panel as a session waiting
for input, and would have stayed there forever, asking for an answer
nobody could give. The pid is now pinned to the process start time from
/proc/<pid>/stat, recorded when the state is written and compared when it
is read.

Files written before that field existed compare only on existence, as
before, so a session open across the upgrade is not evicted.

An abandoned flock needed nothing: the kernel drops it when the holder
dies, so there is no deadlock to recover from.

tests/test-hook.sh

@@ -36,6 +36,11 @@ ev() { # event [extra json]
 emit "$(ev SessionStart '"source":"startup"')"
 check "SessionStart -> waiting" "waiting" "$(field state)"
 
+# Pins the recorded pid to one process, so a state file that outlives a reboot
+# cannot be revived by whatever inherits that pid number next.
+start=$(field pid_start)
+check "process start time recorded" "yes" "$([ -n "$start" ] && [ "$start" != "0" ] && echo yes || echo no)"
+
 emit "$(ev UserPromptSubmit '"prompt":"hi"')"
 check "UserPromptSubmit -> busy" "busy" "$(field state)"