fix(core): address dev server review follow-up

[snvtac]

Problem

Fixes #147.

PR #136 left two non-blocking dev-server robustness follow-ups:

• the singleton guard's same-ppid carve-out also matched two npm run dev jobs backgrounded from the same shell, letting both proceed as if they were a tsx-watch relaunch;
• the EADDRINUSE rebind retry timer was unref'ed, so the process could exit before the scheduled retry fired if no other handle kept the event loop alive.

Issue #, if available: #147

Changes

• Tighten evaluateSingleton() so the same-ppid hot-reload carve-out only proceeds when the recorded owner process is dead; a live same-parent owner that still holds the port now exits like any other competing supervisor.
• Update the singleton guard JSDoc/test comments to describe the same-parent boundary accurately.
• Add scheduleBindRetry() and wire the EADDRINUSE retry path through a refed timer, removing the retry-timeout unref().
• Add regression coverage for same-parent live-owner contention and for keeping the front-door retry timer refed.
• Add a patch changeset for @aws-blocks/core.

Validation

• npm run build -w packages/hosting -w packages/pipeline
• npm run build -w packages/core
• node --test dist/scripts/dev-server-reclaim.test.js (38 tests pass)
• npm run test -w packages/core (582 tests pass)
• git diff --check
• npx biome lint --skip=correctness/noUndeclaredDependencies packages/core/src/scripts/dev-server.ts packages/core/src/scripts/dev-server-reclaim.test.ts
• npx tsx scripts/verify-changeset-coverage.ts

Checklist

• PR description included
• Tests are changed or added
• Relevant documentation is changed or added (JSDoc updated; no external docs needed)

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.