End the watch workout session from durable state, not a view

The HKWorkoutSession that keeps the watch app foregrounded was ended only
by ActiveWorkoutGateView's onChange(of: activeWorkouts) — a view-level side
effect. When a run ended from the phone while the watch app was
backgrounded (kept alive only by the session) or torn down and rebuilt with
an already-empty list, that onChange never fired: the session leaked (the
app kept re-foregrounding on every wrist raise) and finishAndSave() never
ran, so the HR/energy summary was neither saved to Health nor forwarded.

Move session-end off the view into a long-lived WorkoutSessionCoordinator
owned by WatchAppServices, driven by a new bridge.onWorkoutsChanged
callback fired after every authoritative cache mutation (phone push or the
watch's own optimistic edit). The decision is a pure SessionEndPlanner
seam (mirrors WatchCacheApplier): a running session ends only on a genuine
non-empty -> empty transition of the active set, so the launch race (session
running before the run doc syncs) resolves to .none and never discards a
run we haven't heard about yet. Same move as the live-mirror's
repairFromDurable, one layer down.

Watch-only; no schema or wire change. SessionEndPlannerTests pins the
decision table; the OS-initiated-end path (system ends the session itself)
stays a documented residual in PLAN-watch-session-end.md.

Workouts Watch App/Connectivity/WatchConnectivityBridge.swift

@@ -19,6 +19,12 @@ final class WatchConnectivityBridge: NSObject {
     /// Last time state was received from the phone (for a sync indicator).
     private(set) var lastSyncDate: Date?
 
+    /// Fired after every authoritative cache mutation (a phone push applied, or the watch's
+    /// own optimistic `update(workout:)`), once the write is committed. The
+    /// `WorkoutSessionCoordinator` hangs off this to end the `HKWorkoutSession` from the
+    /// authoritative data rather than a view observer — see `WorkoutSessionCoordinator`.
+    var onWorkoutsChanged: (() -> Void)?
+
     /// Exclusive-edit lock pushed by the phone. While set, the watch parks the matching
     /// run (popping out of its progress view) and blocks re-entry, so the phone owns the
     /// edit and the watch can't clobber it with a stale optimistic write. `editingWorkoutID`
@@ -113,6 +119,7 @@ final class WatchConnectivityBridge: NSObject {
         }
         Self.log.info("applyState: applied \(splits?.count ?? 0) splits, \(workouts?.count ?? 0) workouts")
         lastSyncDate = Date()
+        onWorkoutsChanged?()
     }
 
     func requestSync() {
@@ -128,6 +135,7 @@ final class WatchConnectivityBridge: NSObject {
     func update(workout doc: WorkoutDocument) {
         CacheMapper.upsertWorkout(doc, relativePath: doc.relativePath, into: context)
         try? context.save()
+        onWorkoutsChanged?()
         sendToPhone(doc)
     }