fix: exact session target in CreateWindow, shared key replay, sorted validate

[bthall]

Summary

Three consistency fixes, each with a test.

Exact session target in CreateWindow

CreateWindow targeted SESSION: while every other session target uses the = exact-match prefix. Without it tmux falls back to prefix matching, so a missing session resolves to a longer-named one and the window lands there. It now targets =SESSION:.

TestCreateWindowExactSessionMatch fails on the old code and passes on the new. I also re-drove the multi-window build and mox new -w with the built binary on an isolated tmux server, with a decoy session holding a longer name:

== cx windows
1:one panes=2
2:two panes=1
== decoy windows
1:bash
== cx windows after -w
1:one
2:two
3:adhoc

Shared key-repeat replay

The hub and the editor each had their own loop for splitting batched runes, and they disagreed. The hub kept replaying after a quit, so a fast qi on a tmux-only session imported it instead of quitting. The editor stopped correctly, but its comment said the rest of the batch replayed.

Both now use replayRunes in picker_ui.go. It collects each rune's commands and stops at the rune that quits or suspends for $EDITOR. Both models expose that through quit() / isLeaving().

Sorted layouts in mox validate

Layouts printed in map order, so the listing changed between runs. They now go through a new ListLayoutNames() like sessions do. runValidate writes through cmd.OutOrStdout() so the order is testable.

go test -race ./..., make integration (isolated server), and golangci-lint v2.12.2 are clean. Changelog updated under [Unreleased].