fix(relay): drain sessions before idle hub cleanup

[wolfy-j]

Relay's central inactivity sweep cancels a disconnected user hub, whose cleanup then cancels its session plugin. That bypasses Session's cooperative finish and can interrupt long-running server-side work even after Session defers disconnect retirement.

The sweep now sends a private retirement request. A disconnected hub waits for its monitored session plugin to exit before ordinary cleanup. JOIN cancels retirement and resumes the same plugin; an empty hub exits immediately. Retirement survives hot upgrade, and a retiring hub does not restart the session plugin it is waiting to collect.

Only the owning central PID can request hub retirement. Central does not forward incoming retirement requests as trusted broadcasts, and only the registered hub PID can update its client count. The change adds no timers, worker coroutines, acknowledgements or grace-period machinery. Explicit service cancellation keeps its forced-shutdown behavior.

Validation:

• Full Relay suite after merging current master: 43 passing cases, including 21 native cases. Client ownership and the real live-upgrade regression from fix(relay): enforce connected-client ownership before command dispatch #176 are preserved. New regressions cover suspended session work followed by both process exits, reconnect, stale retirement with a connected client, foreign/forwarded retirement, empty hub cleanup and failed request delivery.
• Relay lint: 23 entries, clean; make check-manifests: passing.
• Both branch sources together: two native smoke cases through the actual Relay -> Session plugin -> Session -> suspended provider -> stored tool effect path; one edit stored and hub/session registry names released.
• Runtime: signed Wippy v0.3.48a. No UI changes.

Companion: wippyai/session#65

Deploy with the companion Session lifecycle fix: Session must allow accepted work to finish when receiving shutdown. Other plugins retain their existing hub-cleanup behavior. This PR changes inactivity collection, not administrative service cancellation or redeploy policy.