fix(claude): retire cancelled control requests during replay

[dines-rl]

Claude replay re-dispatched historical control requests after control_cancel_request, causing a cancelled AskUserQuestion to park again on reconnect. Correlate agent cancellations by their top-level request_id, alongside existing user response pairing, so only pending requests reach application handlers.

An SSE disconnect before the captured replay head also used to flush requests before their responses or cancellations could arrive. Keep the replay buffer with the transport's resume cursor, finish correlation after reconnect, and clear it on close. This shared transport correction also applies to Codex.

Validation: bun run check, bun run typecheck, bun run build, and bun run test pass (28 files, 662 tests). New contract tests instantiate the real Claude connection, transport, and read loop against a fake Axon boundary. They cover the REF-249 cancellation fixture with full/bounded replay, allow/deny/error responses, request-specific cancellation and origin checks, pending questions preceding newer queries, replacement connections preserving request identity, and disconnects during replay.

Upstream prerequisite for REF-249; this PR does not complete the issue. Reflex still needs shared browser/MCP lifecycle interpretation and request-aware recovery bounds, with its application integration coverage. Its current newest-prompt bound can omit an older pending request. No broker change is included. Package versioning follows the repository's Release Please workflow; Reflex currently consumes the latest published version, 0.4.13.

[reflex-loop]

⏹️ Reflex agent status: Stopped

Agent	Status
agt_5SgaR3Ite42VdgrK5mY2jJ	⏹️ Stopped

This PR was created by Reflex.

_{This comment updates in place as agents work.}