Finalize run.json when the process crashes

[TheGreatAxios]

Summary

• Export a narrow RunStateHandle (session id, cwd, active flag, task, startedAt, model) from runTUI's setup into a module-level slot (src/session/active-run.ts), registered the moment a run starts, kept in sync wherever runTUI already tracks those fields, and cleared on every path that already finalizes run.json itself.
• handleFatal in src/index.ts reads that slot and, before process.exit, best-effort writes status: "crashed", finishedAt, and the error message through a new saveCrashState in src/session/state.ts — built entirely from the handle, with no disk read. loadState here would be a plain readFile with no timeout, the exact unbounded crash-path I/O primeCrashReporting exists to avoid for git.
• saveCrashState bypasses the per-session writeChains map (a hung queued write must never block process.exit), but a bypass alone can't stop an in-flight progress snapshot's rename() from landing after it and resurrecting status: "running". handleFatal now calls markCrashed() first, and saveState checks a synchronous isCrashed() flag immediately before each queued write actually fires, so anything still waiting in the chain at that moment steps aside. This can't recall a write whose writeFile/rename is already dispatched to the kernel — that residual window is one atomicWrite call wide, not the process's remaining lifetime.
• "crashed" is a new terminal RunState status, excluded from isResumableByDefault (like "done"/"failed"), so a crashed session no longer appears as an incomplete resumable run in the picker.
• installCrashHandlers is factored out of src/index.ts's entry block so an integration test can register the real crash handlers without spinning up the TUI.

Verification

• bun run typecheck
• bun run build
• bun run test — 3984 pass, 0 fail
• tests/integration/crash-finalize.test.ts spawns a subprocess fixture that registers the active run and crash handlers, then parks two unawaited straggler "running" snapshot writes behind a test-only write gate (setTestWriteGate in active-run.ts) that it only releases after the crash handler has flipped isCrashed() — guaranteeing both writes are still queued, not dispatched to the kernel, at that exact moment, rather than hoping real filesystem timing lines up. Asserts the resulting run.json has status: "crashed", a finishedAt, the error message, the right task/model (recovered from the handle, no read), and is excluded by isResumableByDefault.
  • An earlier version of this test fired 50 unawaited writes with no ordering control and was a coin flip (reviewer measured 5/13 passes with the guard removed, when it should fail every time). With the write gate making the ordering deterministic: 25/25 passes with the guard in place, and removing if (isCrashed()) return; reliably lets a parked write win the race again (9/15 failures observed in that state — still probabilistic without the fix, as expected, since that's a real race).

Closes CL-5574

[linear-code]

CL-5574