Post-1.3: incompatible sessions should only offer replacement/delete/purge

[ebursztein]

Manual 1.3 testing showed an incompatible stopped session could still be selected as if it might resume. Example TUI state:

tmp-2
stopped
profile 'code' payload hash mismatch: VM pinned 'blake3:cfe674e...', current 'blake3:189846...'
Press Enter to create a replacement
Alt+d deletes this session; Alt+p purges temporary/broken sessions

Expected behavior:

• Incompatible/defunct sessions must never route into launch/resume.
• Primary action should be create replacement.
• Destructive cleanup actions should remain delete/purge.
• UI/TUI/CLI/API should present the same state machine.

This is post-1.3 unless it causes actual resume attempts against broken disks during release validation.