refactor(device): hand a capture session its host handles as CaptureHost

Both capture entry points, and the `_on` functions under them, took the same
five values after the route and the plan: the input sink, the shutdown
receiver, the channel slot, the registry and the io gate. That is seven
positional arguments repeated across four signatures, and the five always
travel together.

`CaptureHost` names them. The agent's two watchers and the replay test build
one; nothing else about the sessions changes.