Fix out-of-order session recovery

[wangalec]

Why

Out-of-order River messages currently only close the active connection, which lets poisoned sessions transparently reconnect and repeat the same sequencing failure. This hardens recovery so corrupted sessions reconnect cleanly instead of reusing broken state.

What changed

• treat forward sequence gaps as invalid session state and trigger a hard reconnect instead of silently preserving the existing session
• keep generic invalid-message handling unchanged so parse failures do not loop on reconnect
• add state machine and transport coverage for server-detected and client-detected out-of-order recovery paths

Versioning

• Breaking protocol change
• Breaking ts/js API change

Test plan

• direnv exec /home/developer/replit/river npm exec eslint -- transport/sessionStateMachine/SessionConnected.ts transport/client.ts transport/server.ts transport/sessionStateMachine/stateMachine.test.ts transport/transport.test.ts
• direnv exec /home/developer/replit/river npm run test:single -- transport/sessionStateMachine/stateMachine.test.ts transport/transport.test.ts

Revertibility

Safe to revert. This only changes River transport recovery behavior and tests; it does not change the wire schema or any persisted state.

~ written by Zerg 👾