Fix a race that could crash the Mac app when the decode-service connection closed during a request. Command writes now retain their own descriptor and reject stale connections. Also correct the connection-lifecycle test that exposed the failure.
CI passed. Real-app checks covered generation, cancellation, unload/load, and recovery after terminating the decode helper.
Known limitation: if the helper exits while idle, the UI can still show the model as loaded. Use Unload Model, then Load Model, to recover.
Source-only release. Run Scripts/build_app.sh to build the Mac app locally.
Full changelog: 0.9.2...0.9.3