Fix tab slice rebase retries with planned ranges

[morluto]

Summary

Follow-up to #379.

• Replace live tab-slice rebasing with planned expected→rebased range application, so retry paths are idempotent and unknown states fail closed instead of being rebased again.
• Update visible-root and hidden-session rebase paths to build tab plans from captured pre-await ranges.
• Carry and revalidate hidden-session targets immediately before applying planned tab rebases.
• Add regression coverage for planned rebase idempotency/fail-closed behavior and the hidden-session post-CAS stale-target race.
• Update the XCTest contract ledger for the new and expanded coverage.

Why

This is a focused correctness follow-up to #379, not another CI/test-suite optimization change. That PR included an initial hidden-session slice rebase fix, and review feedback correctly pointed out that the deeper issue was not hidden-session ownership itself, but that tab slice rebasing could become coordinate-epoch ambiguous across async retry boundaries.

The previous tab rebase flow could resume after async partition writes and compute against whatever ranges were live in the tab at retry time. That made already-rebased ranges or stale hidden-session mappings vulnerable to being transformed again.

This change makes tab rebase application explicit: apply only when the tab still matches the captured expected ranges, no-op when it is already at the planned rebased ranges, and skip otherwise.

Reviewer guide

Suggested review order:

1. WorkspaceManagerViewModel.swift

   • planned tab rebase model
   • idempotent/fail-closed application helper
   • CAS retry behavior

2. WorkspaceFilesViewModel.swift

   • visible-root plan construction
   • hidden-session target revalidation before tab apply

3. Regression tests

   • planned helper idempotency/fail-closed coverage
   • hidden-session post-CAS stale-target race coverage

Validation

• make guardrails
• make dev-format
• make dev-swift-build PRODUCT=RepoPrompt
• make dev-test FILTER=PersistentAgentModeMCPReadFileConnectionTests/testAgentOwnedHiddenWorktreeWatcherRebases6500LineReadSlicesBeforePostEditReads
• make dev-test FILTER=SelectionSlicePersistenceAndRebaseTests
• python3 Scripts/test_suite_optimizer.py verify-ledger --ledger Scripts/Fixtures/test-suite-contract-ledger.tsv
• make dev-lint
• .agents/skills/rpce-contribution-check/scripts/preflight.sh commit
• .agents/skills/rpce-contribution-check/scripts/preflight.sh push

Notes

• The fail-closed path only skips tab slice updates when the current tab ranges no longer match a known safe state: either the captured expected ranges or the planned rebased ranges.
• In that ambiguous state, preserving the current tab selection is safer than applying a second best-effort text rebase against ranges that may already be in the new coordinate epoch.
• Normal successful partition and tab rebase behavior is unchanged when the expected ranges still match.
• Full root make dev-test passed earlier during this refactor; after the final stale-target regression hook/test, I reran focused coverage, build, lint, guardrails, and ledger verification.