fix(core): recover idle moves through the selected instance

[kitlangton]

Why

An idle session cannot escape an existing source directory whose instance fails to initialize. For example, a missing {file:./missing.txt} config reference or unreadable directory prevents the source runner from starting, leaving accepted moves stranded in the inbox.

What Changes

Extend the existing missing-source recovery path to failed source-instance initialization:

Source state	Result
Active execution	Keep the runner's normal step-boundary handoff.
Idle, selected instance initializes	Admit the move normally, preserving inbox ordering.
Idle, source missing or selected instance cannot initialize	Apply the validated destination directly, cancel superseded move controls, and retain other queued inputs.
Source probe interrupted	Preserve interruption; do not recover or admit the move.

Selected instance and admission ordering

Probe SessionRunner.Service through instances.provide(session), the same selection boundary used by execution—not the default Location map. A healthy private instance with discovery: false must remain usable even when ambient configuration is broken; a broken private instance must not be mistaken for a healthy default Location. This corrects the selection problem in the closed #46445 approach.

Initialization runs outside the inbox lock so cancellation remains available. Inside the lock, recovery requires the same directory/workspace placement and a fresh idle-execution check. Missing sources still skip initialization entirely.

Scope

Core-only idle-move recovery, with no public API changes. Failed Location-cache eviction and active runner continuation remain separate concerns.

Verification

bun install --frozen-lockfile
cd packages/core
bun run test test/session-move.test.ts -t 'source configuration|unreadable source'
bun run test test/session-move.test.ts -t 'selected instance'
bun run test test/session-move.test.ts test/session-runner.test.ts test/session-execution.test.ts test/session-run-coordinator.test.ts test/location.test.ts test/location-layer.test.ts
bun run test test/session-move.test.ts --rerun-each 3
bun run test
bun typecheck
cd ../server
bun run test test/session-instances.test.ts
cd ../..
bunx prettier --check packages/core/src/session.ts packages/core/test/session-move.test.ts
bunx oxlint packages/core/src/session.ts packages/core/test/session-move.test.ts
git diff --check

• Red first: real Session/SessionExecution fixtures failed for broken source configuration and mode-000 permissions on non-root macOS; the healthy control passed. The broken selected-instance regression also failed before the fix.
• Green: 274 focused tests; all 15 move tests passed across three repeated runs (45 tests); the server selected-instance integration test passed. Core typecheck and all 33 repository typecheck tasks in the unmodified pre-push hook passed.
• Full core suite: 4,029 passed, 39 skipped, zero failures across 227 files, including a final run against the committed code.
• Selection guard: temporarily replacing the probe with default-Location selection made both selected-instance regressions fail; restoring the selected-instance probe passed both.
• Formatting and whitespace checks pass. Targeted lint reports no errors and four warnings on pre-existing code.
• Permission coverage is skipped on Windows and root, where POSIX mode bits cannot establish this fixture. This is real-core integration coverage, not packaged TUI/provider verification; no live server or session was changed.