bug(profiles): session binding store never evicts ended sessions

[danielgap]

Before submitting

• I searched open and closed issues and did not find a report of this problem.
• I reviewed this report and removed credentials, tokens, private paths, hostnames, and other sensitive data.

Problem

The session profile binding store introduced for #1064 (lib/session-profile-binding.ts) keeps every binding forever. bindSessionProfile writes into a process-wide Map behind a Symbol.for key on globalThis, and clearSessionProfileBinding removes one session on demand, but nothing ever evicts bindings for sessions that ended. A long-lived extension host therefore accumulates one cloned routing snapshot per dead session: memory grows without bound and stale entries are never reclaimed.

Raised as advisory R3-binding-store-no-eviction (suggestion) by the review-reliability lens during the native review of PR #1558.

Steps to reproduce

1. In one long-lived process hosting the extension, bind several distinct session ids through the profiles panel (Enter on a profile) across resumed sessions.
2. End those sessions.
3. Inspect the process-wide binding store: every ended session's snapshot is still present, because only an explicit clearSessionProfileBinding or process exit removes entries.

Expected and actual behavior

Expected: a session that ended releases its binding, or the store bounds its size so dead sessions cannot accumulate.
Actual: bindings for ended sessions stay resident for the life of the process.

gentle-pi version

Unreleased: feat/1064-session-effective-routing at 4ffe4f9 (PR #1558).

Pi version

1.0.0

Operating system

Linux

Relevant logs or error output (optional)

No response