fix(relay): preserve sessions across hot upgrades

[wolfy-j]

Summary

• make Relay central and per-user hubs statefully upgradable
• preserve hub PIDs, child plugin PIDs, connected clients, counters, and process-group declarations
• transfer only serializable state and reopen process-group handles after upgrade
• handle Runtime OUTDATED through process.upgrade with no restart fallback

Root cause

Relay services were marked upgradable = false. Package updates therefore could not use Runtime's in-place upgrade protocol, and external force termination broke active WebSocket/user-hub continuity.

Verification

• Framework CI: Relay lint passed and all 19 Relay tests passed under v0.3.26a
• Framework CI module-manifest validation passed
• v0.3.26a live E2E:
  • central PID remained 0x00004
  • user-hub PID remained 0x00055
  • a WebSocket open before both upgrades stayed open
  • a second WebSocket connected after both upgrades
  • a Hub UI package install completed with the original WebSocket still open
  • full application restart restored registry history and accepted a fresh WebSocket