Boron Context v0.7.2: fail-closed session scope

[kforris]

Summary

• reject cross-project reuse of an active external session before lease or metadata updates
• preserve the persisted canonical project on same-project resume
• synchronize the 0.7.2 package, menu-bar, plugin cache key, changelog, and release notes

Verification

• npm run check — 60 passed, 9 gated skips
• isolated PostgreSQL 17 migration + npm run test:postgres — 9 passed
• npm run format:check
• npm audit --omit=dev --audit-level=high — 0 vulnerabilities
• swift test --package-path apps/BoronMenuBar — 5 passed
• swift build -c release --package-path apps/BoronMenuBar
• npm pack --dry-run --json — package 0.7.2