Drop late diagnostic results with run tokens (#409 S4) #488

Part of #409: slice S4 of the capability-aware diagnostics design. Depends on S1 and S2.

Scope

• A run generation that each diagnostic controller increments when it reruns or when the user's selection changes.
• A late-result helper that applies a result only while its RunToken (epoch, session generation, run generation) is still the current one.

Acceptance criteria

• A result is dropped after:

  • a context switch;
  • a credential replacement;
  • a newer run;
  • a selection change.

  It is applied otherwise.