fix(core): isolate stale proposals from WatchService

[robinbraemer]

Summary

• reject an expired or superseded session proposal without rethrowing its runtime failure through the WatchService callback
• keep serious JVM Errors fatal while containing ordinary per-session failures
• cover duplicate/superseded admission delivery and prove the watch stream is not re-created

Why

Discord support logs from endpoint aganmc showed a Java-only connector repeatedly losing WatchService after a Bedrock admission was superseded. A stale individual proposal is expected to be rejectable; it must not take every healthy Java session proposal offline by escaping the per-session handler.

Verification

• git diff --check
• targeted Gradle test prepared; local execution is blocked at protobuf generation because protobuf 3.19.4's osx-aarch_64 artifact is actually an x86_64 Mach-O on this arm64 host
• required Linux/JDK 17 and 21 repository CI will compile and run the regression before merge