fix: prevent silent data loss on failed workspace session hydration (#1158)

[blut-agent]

Problem

When workspace session hydration fails on startup, the error handler in App.tsx calls hydrateWorkspaceSession({ tabsByWorktree: {}, ... }) with empty tabs. The debounced session writer picks up this empty state and permanently overwrites orca-data.json, deleting the user's tab state with no recovery path.

Fixes

Three layered fixes addressing different failure modes:

1. Gate session writer on hydration success (primary fix)

Add a hydrationSucceeded flag in the main process Store. setWorkspaceSession() returns early until markHydrationSucceeded() is called by the renderer after a successful hydration. This prevents the error-handler path (empty tabs) from being persisted to disk.

2. Rolling backups before overwriting (safety net)

Before writing orca-data.json, rename the existing file to .bak and .bak.1. Wrapped in try/catch so backup failures never block the write. If a bad write occurs, the user can recover from .bak.

3. Broaden worktree-id filter guard (edge case)

In hydrateWorkspaceSession, also allow worktrees with undefined IDs (folder repos, certain SSH setups). Previously only 'default' worktrees were preserved, silently dropping tabs from other worktrees.

Files Changed

File	Change
src/main/persistence.ts	Add hydrationSucceeded flag + rolling backup
src/main/ipc/session.ts	New session:mark-hydration-succeeded IPC handler
src/preload/index.ts	Expose markHydrationSucceeded() to renderer
src/renderer/src/App.tsx	Call markHydrationSucceeded() after successful hydration
src/renderer/src/store/slices/terminals.ts	Allow undefined worktree IDs in filter

Test Plan

• tsc --noEmit passes with zero errors
• Existing workspace-session and terminals tests pass
• Manual: verify tabs survive a simulated hydration failure