Post-1.3: incompatible sessions should only offer replacement/delete/purge

Manual 1.3 testing showed an incompatible stopped session could still be selected as if it might resume. Example TUI state:

```
tmp-2
stopped
profile 'code' payload hash mismatch: VM pinned 'blake3:cfe674e...', current 'blake3:189846...'
Press Enter to create a replacement
Alt+d deletes this session; Alt+p purges temporary/broken sessions
```

Expected behavior:
- Incompatible/defunct sessions must never route into launch/resume.
- Primary action should be create replacement.
- Destructive cleanup actions should remain delete/purge.
- UI/TUI/CLI/API should present the same state machine.

This is post-1.3 unless it causes actual resume attempts against broken disks during release validation.

Trace how incompatible or defunct sessions are represented and routed across the UI, TUI, CLI, and API state machine. Verify that the primary action creates a replacement, cleanup offers delete or purge, and no path presents launch or resume for these sessions.

Written by the indexing model from the issue text.