Per-connection `seen_ids` set grows without bound

[nficano]

Category: bug Severity: minor
Location: crates/arcp-runtime/src/runtime/server.rs:390, :402
Spec: n/a

What

Transport-level dedup stores every inbound MessageId in a HashSet that is never pruned for the life of the connection. A long-lived session (the intended durable-job use case) leaks memory proportional to the total number of messages ever received, with no cap or windowing.

Evidence

let mut seen_ids: HashSet<MessageId> = HashSet::new();
// ...
if !seen_ids.insert(envelope.id.clone()) {
    tracing::debug!(id = %envelope.id, "dropping replayed envelope");
    continue;
}

Proposed fix

Replace with a bounded structure (ring buffer / LRU of recent ids, or a sliding window keyed on message ordering). Replays realistically only need a recent window, not all-time history.

Acceptance criteria

• Memory for dedup state is bounded under a sustained inbound message stream on one connection.
• Recent-duplicate detection still works within the chosen window.