fix(pi): keep identity across /reload, /new, /resume and /fork

Pi fires session_shutdown for reload/new/resume/fork as well as quit, but
only quit ends the process. The plugin hard-stopped on every reason, deleting
the live instance; the following pi-start then hit restore_stopped with no
row to restore into, failed the session_bindings FK, and still returned the
name with a process binding to the missing row.

- plugin: only pi-stop on quit (or no reason, older Pi); session_start
  rebinds the same identity through the process binding
- restore_stopped: return None when there is no row to restore into instead
  of binding the process to a missing instance
- restore_stopped: when a live identity switches into another agent's stopped
  session, retire the old identity (as the canonical-exists path does) rather
  than leaving it listening without a process
- session switch: soft-stop the retired identity with a stopped event, so
  resuming its session later switches back to it instead of binding that
  history to the current agent
- session switch: move pid/launch_context to the new identity and clear the
  old pid, so the new name stays killable and the old one can't kill it

Fixes #141