End the watch workout session from durable state, not a view

The HKWorkoutSession that keeps the watch app foregrounded was ended only
by ActiveWorkoutGateView's onChange(of: activeWorkouts) — a view-level side
effect. When a run ended from the phone while the watch app was
backgrounded (kept alive only by the session) or torn down and rebuilt with
an already-empty list, that onChange never fired: the session leaked (the
app kept re-foregrounding on every wrist raise) and finishAndSave() never
ran, so the HR/energy summary was neither saved to Health nor forwarded.

Move session-end off the view into a long-lived WorkoutSessionCoordinator
owned by WatchAppServices, driven by a new bridge.onWorkoutsChanged
callback fired after every authoritative cache mutation (phone push or the
watch's own optimistic edit). The decision is a pure SessionEndPlanner
seam (mirrors WatchCacheApplier): a running session ends only on a genuine
non-empty -> empty transition of the active set, so the launch race (session
running before the run doc syncs) resolves to .none and never discards a
run we haven't heard about yet. Same move as the live-mirror's
repairFromDurable, one layer down.

Watch-only; no schema or wire change. SessionEndPlannerTests pins the
decision table; the OS-initiated-end path (system ends the session itself)
stays a documented residual in PLAN-watch-session-end.md.

Workouts Watch App/WatchAppServices.swift

@@ -11,6 +11,10 @@ final class WatchAppServices {
     let container: ModelContainer
     let bridge: WatchConnectivityBridge
 
+    /// The single owner of workout-session termination. Built in `bootstrap` once we have the
+    /// delegate's session manager to reference; nil until then.
+    private var sessionCoordinator: WorkoutSessionCoordinator?
+
     init() {
         let container = WorkoutsModelContainer.make()
         self.container = container
@@ -20,7 +24,22 @@ final class WatchAppServices {
         #endif
     }
 
-    func activate() {
+    /// Wire the session coordinator to the (delegate-owned) session manager, start the bridge,
+    /// and seed the coordinator's baseline from whatever state is already applied. The manager
+    /// is passed in rather than owned here so the delegate's `handle(_:)` and the view tree's
+    /// `.environment(...)` keep referencing the same instance.
+    func bootstrap(sessionManager: WorkoutSessionManager) {
+        let coordinator = WorkoutSessionCoordinator(
+            sessionManager: sessionManager,
+            bridge: bridge,
+            context: container.mainContext)
+        self.sessionCoordinator = coordinator
+        // weak break: the coordinator is held here; the bridge only borrows it.
+        bridge.onWorkoutsChanged = { [weak coordinator] in coordinator?.reconcile() }
         bridge.activate()
+        // Seed `previouslyActiveIDs` from whatever the bridge already applied at launch, so the
+        // first real change is measured against a correct baseline (and the launch race — a
+        // running session before the run doc arrives — resolves to `.none`, never a discard).
+        coordinator.reconcile()
     }
 }