fix: refresh runtime credentials and stabilize console sessions

[Dts0]

Summary

Fixes #89.
Fixes #106.

This PR improves the reliability of long-running Colab CLI sessions, particularly around expired runtime-
proxy credentials and interactive Console connections.

Runtime-proxy token refresh (#106)

• Refreshes runtime-proxy tokens and URLs from /tun/m/assignments during session resolution.
• Retries runtime-proxy authentication failures once with refreshed credentials.
• Preserves local session bindings when credential refresh is inconclusive.
• Removes a local session only after confirming that its exact server-side endpoint is gone.
• Uses endpoint-guarded, field-level state updates so stale commands cannot overwrite refreshed credentials,
  revive deleted sessions, or modify same-name replacement sessions.
• Applies credential recovery consistently across execution, file operations, automation, run, restart- kernel, Console, and SSH.
• Distinguishes tunnel-level authentication failures from normal Contents API “file not found” responses.
• Keeps SSH 404 behavior unchanged because it normally indicates that the runtime does not expose the SSH
  endpoint.

Console reliability (#89)

• Adds WebSocket ping/pong liveness checks and visible reconnect status messages.
• Automatically reconnects dropped interactive Console connections with bounded backoff and refreshed
  credentials.
• Reuses a single stoppable stdin-forwarding thread across reconnects, preventing thread and object
  accumulation.
• Preserves normal shell-exit, piped-input, local-stop, and same-name replacement semantics.
• Bounds control-plane refresh calls so a failed proxy or stopped session cannot leave Console appearing
  frozen.
• Implements the /colab/tty application-level flow-control protocol: Console now acknowledges marked
  output after flushing it locally, preventing the remote PTY from pausing permanently after approximately 600
  KB of output.

Testing

• Full unit test suite: 396 passed.
• Ruff passed for all changed Python files.
• Added CPU-only end-to-end regressions that:
• corrupt saved runtime-proxy credentials and verify automatic recovery for ls, exec, and piped
  console;
• force Console transport failures and verify visible reconnection, credential-refresh fallback, and local
  session removal handling;
• stream beyond the previous 600 KB PTY pause threshold and verify that output continues to a trailing
  sentinel.
• All live tests use isolated session state without GPU or TPU flags, clean up their exact test endpoints,
  and verify that pre-existing assignments remain unchanged.