Merge dev into main - #28

Review round 1 follow-ups on the eviction re-validate fix (issue StreamController#4):

- Reframe the risk model: eviction is a purely in-memory teardown (no
  Page.save/atomic_write_json, never touches the page JSON), so StreamController#4's harm
  is USE-AFTER-EVICT -- a visible page whose actions are all dead plus a
  duplicate Page minted on the next get_page() -- recoverable by a page
  reload/replug, NOT on-disk data loss. Documented at the eviction path.

- Add a window-3 leg to scenario_eviction_revalidate: a get_page() during
  the teardown gap must receive a FRESH Page (via StreamController#28's single-flight
  builder), not the gutted corpse. Red-checked -- with gut-before-pop
  restored the leg fails ("handed the gutted corpse").

- Document that remove_page's own out-of-lock clear_action_objects needs
  NO _page_is_live guard: the cache is keyed per-controller (distinct Page
  per (controller, path)) and load_page() moves active_page onto a
  different path before the pop, so it can never gut a live/pending page.

- Pin the #81 residual in a comment: a page fetched via get_page() but not
  yet load_page()'d is born ready_to_clear=True and stays evictable in the
  pre-activation window; harm is narrow (action_objects empty pre-init, so
  teardown is a near-no-op -> only the duplicate-Page mint). Deferred to #81.