fix: recover orphan PROCESS through existing rebind surface

[James3014]

Supersedes #294 after main advanced via #295 / #242.

Issue #240 exposed a remaining host-coupling bug: a critical recovery path depended on ChatGPT hot-adding a newly advertised top-level MCP tool to an already-open conversation. The server correctly sent tools/list_changed, but the active host projection could remain stale.

This change removes that dependency without weakening Core semantics. The already-existing core_mutation_session_rebind schema remains unchanged. When its existing evidence field carries a strict devspace.core_mutation_rebind_owner_recovery.v1 envelope and the exact bound session is PROCESS / OUTCOME_UNKNOWN, DevSpace first runs the existing owner-only orphan-PROCESS physical reconciliation path, then performs the normal atomic caller rebind. Foreign owner clients, malformed envelopes, scope escapes, deletion violations, ACTIVE/UNKNOWN process writers, and ordinary non-recovery rebinds remain fail-closed.

Latest-main base includes #295/#242:

• source: c03753296ef2127457e9a83274c028b77915e384
• Candidate: 88a00e11d17831cca35801870ad3a6aad4367ed6
• tree: f71101cbe40b5165d53f2c1b4fd20ef76a705293
• diff hash: sha256:533746ca69c9ee66a75e600677846f87dec266f96c33f5fd5b0efdc68a179335
• changed paths: exactly src/core-mutation-tools.ts, src/server.test.ts
• no deletions / no scope escapes

Verification on latest main:

• owner recovery + hostile cases: 3/3 PASS
• caller rebind suite: 8/8 PASS
• typecheck: PASS
• production build: PASS
• git diff --check: PASS
• full server.test.ts: 87/88; sole failure is the pre-existing Issue P0: harden ChatGPT -> Dev MCP dispatch reliability end to end #194 G2 ECONNRESET transport test; all P0: fix ChatGPT↔DevSpace caller continuity, live tool projection, and evidence-chain liveness #240 cases PASS.