fix(kernel,server): evict per-session caches on workflow termination (#54)

Two unbounded per-session leaks that never released after a workflow ended:

- SessionOrchestrator.artifactContentCache (full file contents, keyed
  "<sessionId>:<path>") grew for the process lifetime. Added
  evictArtifactContentCache(sessionId) — session-prefix key removal,
  rehydrate-safe — called on both completeWorkflow and failWorkflow.
  cancellations was already evicted on both terminal paths.

- NarrationSubscriber leaked a Channel + worker coroutine + lanes map entry
  per session forever. closeLane() now closes the lane channel on
  WorkflowCompleted/WorkflowFailed (draining the terminal narration first);
  the worker self-removes from lanes when its for-loop exits on close.

Deferred: SqliteEventStore.subscriptions eviction — removing the SharedFlow
mid-life would strand LiveArtifactRepository's downstream collector (a
suspended-coroutine leak worse than the tiny empty-SharedFlow entry).

Green: :core:kernel compile+detekt, :apps:server *NarrationSubscriber* (8).

apps/server/src/main/kotlin/com/correx/apps/server/narration/NarrationSubscriber.kt

@@ -104,22 +104,28 @@ class NarrationSubscriber(
                     stageId = p.stageId.value,
                 ),
             )
-            is WorkflowCompletedEvent -> enqueue(
-                sid,
-                NarrationTrigger(
-                    kind = "workflow_completed",
-                    instruction = "The workflow finished successfully. Provide a brief summary.",
-                    stageId = p.terminalStageId.value,
-                ),
-            )
-            is WorkflowFailedEvent -> enqueue(
-                sid,
-                NarrationTrigger(
-                    kind = "workflow_failed",
-                    instruction = "The workflow failed in stage ${p.stageId.value}: ${p.reason}. Explain the failure to the user.",
-                    stageId = p.stageId.value,
-                ),
-            )
+            is WorkflowCompletedEvent -> {
+                enqueue(
+                    sid,
+                    NarrationTrigger(
+                        kind = "workflow_completed",
+                        instruction = "The workflow finished successfully. Provide a brief summary.",
+                        stageId = p.terminalStageId.value,
+                    ),
+                )
+                closeLane(sid)
+            }
+            is WorkflowFailedEvent -> {
+                enqueue(
+                    sid,
+                    NarrationTrigger(
+                        kind = "workflow_failed",
+                        instruction = "The workflow failed in stage ${p.stageId.value}: ${p.reason}. Explain the failure to the user.",
+                        stageId = p.stageId.value,
+                    ),
+                )
+                closeLane(sid)
+            }
             // Surface the semantic reviewer's verdict conversationally instead of a raw findings
             // dump: the narrator turns "FAIL, 2 findings" into a plain-language explanation the
             // operator can act on. Only narrate when there's something to say (non-PASS or findings).
@@ -221,6 +227,13 @@ class NarrationSubscriber(
         lanes[sessionId.value]?.pendingPauses?.clear()
     }
 
+    /** Closes a terminated session's lane so its worker drains any buffered narration (the terminal
+     *  one enqueued just before this) and then exits, self-removing the lane from [lanes]. Without
+     *  this, every session leaks its channel + worker coroutine + map entry forever. */
+    private fun closeLane(sessionId: SessionId) {
+        lanes[sessionId.value]?.channel?.close()
+    }
+
     private fun startLane(sessionId: SessionId): SessionLane {
         val channel = Channel<QueuedNarration>(capacity = Channel.UNLIMITED)
         val lane = SessionLane(channel, used = 0)
@@ -249,6 +262,9 @@ class NarrationSubscriber(
                         )
                     }
             }
+            // Channel closed on workflow termination: drop the lane so it stops leaking. A later event
+            // for the same session (none expected post-terminal) would lazily start a fresh lane.
+            lanes.remove(sessionId.value)
         }
         return lane
     }