Provisional site-actor cleanup never runs: the binding key is split on the wrong separator

The bug

extension/background/origin-lock-controller.js splits a site-actor binding key on a space:

for (const [key, sessionId] of siteActorBindings.entries()) {
  if (sessionId !== actorSessionId) continue;
  const gap = key.indexOf(' ');
  if (gap < 0) continue;
  siteActorBindings.drop(key.slice(0, gap), key.slice(gap + 1));
  dropped = true;
}

makeApiActorBindings (extension/peerd-runtime/actor/web-actor.js) joins that key with a NUL, not a space:

const keyOf = (ownerChatId, origin) => `${ownerChatId}\u0000${origin}`;

So gap is always -1, the continue always fires, drop is never called, dropped stays false, and persistSiteActors() never runs.

What it costs

The block exists so that when a provisional site actor is stopped for landing somewhere it should not be, its binding is removed and a retry mints a fresh actor. With the cleanup dead, the binding survives the stop: a retry resolves the same stopped actor session and, per the block's own comment, can reopen an orphaned tab instead of starting clean.

The stopped state still fences queued calls, so this is a recovery-quality bug rather than an authority bypass.

Fix

Split on the separator the writer actually uses, and prefer asking the binding map to do it rather than re-deriving the key shape in a second file - a separator that lives in two places is exactly how this drifted.

Add coverage that stops a provisional site actor and asserts the binding is gone: the current code passes every existing test while doing nothing.

Provenance

Introduced in #418, which moved this block into origin-lock-controller.js. The separator is a NUL in the writer and a space in this reader. Found while mapping the dispatcher for #234.

Start in extension/background/origin-lock-controller.js and compare its binding-key handling with keyOf in extension/peerd-runtime/actor/web-actor.js. Trace the provisional site-actor stop path, then add coverage that stops one and verifies its binding is removed and persistence occurs. Run the relevant existing test suite to confirm cleanup and retry behavior.