fix: preserve durable Telegram routing

[TerrifiedBug]

Summary

• prevent task/scout agent_end events from replacing the parent session's topic and DM-owner identities
• resolve omitted telegram_send, telegram_ask, and telegram_react targets from exact durable session claims after restart
• keep foreign claims fail-closed and document the resolution order
• narrow inbound bridge-administration guidance so opaque proof tokens are not treated as access-change requests

Verification

• bun run check — TypeScript clean, 288 tests passed

Closes #64
Closes #62
Closes #58
Closes #38