[EPIC] Fix leaked timers, stream subscriptions, and lifecycle listeners

View-models subscribe to CAMS streams but never store or cancel subscriptions, one getter subscribes *per call*, and the serialization base class stacks OS lifecycle listeners on every re-init. Goal: every subscription/timer/listener in `lib/view_models` and `lib/blocs` has an owner and a cancellation point, enforced by lints.

Complements #597 — the bloc's own message-timer and dispose leaks are already scoped in #592 and are **not** repeated here; widget-level leaks are fixed structurally by #604.

**Definition of done:** all leaks below are fixed and the `cancel_subscriptions`/`close_sinks` lints are on in CI.

Line references in sub-issues are against branch `chore/cams-2.x-upgrade` @ 560a181.