fix(provider-tangle): validate exact interactive session identity

[drewstone]

What changed

• compare the full retained interactive reference before control operations
• fail closed when Sandbox reports a replaced process
• test the real launch generation fence before claiming control
• release patch updates for the provider and conformance package

Proof

• provider: 140/140 tests passed
• provider testkit: 24/24 tests passed
• both package typechecks passed
• changeset status passed
• pre-commit and pre-push checks passed
• merge-tree against origin/main passed

[tangletools]

✅ Auto-approved drewstone PR — e3d812c7

This PR was opened by the trusted drewstone account.
The full PR reviewer audit still runs separately and will publish findings if it detects issues.

This approval is provisional. It rests on the audit running. If the audit cannot run — for example the CLI bridge rejects it — this approval is dismissed rather than left standing, so an unrun check never reads as a passing one.

_{tangletools · auto-approval · reason: drewstone_author · 2026-08-16T10:53:11Z}