fix(actor): drop a stopped provisional site actor's binding

[jonybur]

Closes #438.

What broke

The cleanup that removes a provisional site actor's binding when the actor is stopped split the binding key on a space. The map that writes that key joins with a NUL. indexOf(' ') was therefore always -1, the loop always hit its continue, and the drop never ran.

So a provisional site actor stopped for landing outside its boundary kept a live binding: a retry resolved the stopped session instead of minting a fresh actor, and per the block's own comment could reopen an orphaned tab. The stopped state still fences queued calls, so this is recovery quality, not an authority bypass.

What changed

The root cause is that the key shape was known in two files. It now lives in one: the binding map gains dropBySession(), and the controller asks for the removal instead of taking the key apart itself.

How it was verified

Two regression tests, driving a REAL binding map - every existing test passed while the cleanup did nothing, because none of them used one. Revert-proven: restoring the old loop turns the provisional test red, and the fix turns it green.

Gates: 6413 bun, 948 in-browser, lint, typecheck, boundary, imports, tscheck, copy.

Found while mapping the dispatcher for #234; filed separately rather than folded into that PR.

[github-actions]

Visual regression

✅ No visual change. All 68 screens render exactly as they do at the merge base.

_{09032f7bf7c6 (merge base) ⟶ 465eb8d21f3f. peerd commits no reference screenshots, so both sides were rendered from source in this run.}