PTY aggregate retention bounds

Trap: per-owner/global count checks look sufficient, but concurrent pty_spawn calls can both pass authorization and stale counts before either inserts a Session. Fix: reserve owner and Location capacity atomically before the first asynchronous spawn boundary, release reservations on failure, combine global bounds with owner quotas, and evict only confirmed-exited owner sessions.