fix(audio): refcounted monitor-mute arbiter (TLC Part II §2)

The old single monitorMuted atomic had five writers fighting
last-writer-wins: the settings checkbox, startup restore, the executor's
preload read-force-restore, releaseRoute's unconditional setMonitorMute(true)
(which clobbered the user's persisted preference), and the renderer's
song-load suppression (un-refcounted — overlapping windows un-suppressed
each other early).

Native arbiter on SourceChain: userMonitorMute (the preference — checkbox +
restore only), refcounted monitorMuteHolds (force-mute overrides), and
refcounted suppressions (setMonitorMuteSuppressed keeps its bool surface;
true=acquire, false=release, clamped at 0). Effective dry-mute =
(holds || pref) && chain empty && no suppression — the suppressed-beats-muted
precedence is unchanged. New exports: acquire/releaseMonitorMuteHold,
getMonitorMuteState (diag); snapshots regenerated.

Executor rewrite: acquires a suppression (dry-during-load, the default) or a
hold, and releases exactly what it acquired via a single-fire closure that
runs UNCONDITIONALLY (each load owns its acquisition — the stale-snapshot
race against a mid-hold user toggle is structurally gone). releaseRoute no
longer touches mute state at all. The ownership test now pins: preference
API never called, acquire/release balanced.

Renderer callers are unchanged: the checkbox writes the preference as
before, and the song-load suppression sites now compose instead of racing.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/contracts/addon-exports.json

@@ -1,4 +1,5 @@
 [
+  "acquireMonitorMuteHold",
   "addSource",
   "bindInputDevice",
   "clearChain",
@@ -17,6 +18,7 @@
   "getDeviceTypes",
   "getKnownPlugins",
   "getLevels",
+  "getMonitorMuteState",
   "getNoteVerdicts",
   "getParameters",
   "getPitchDetection",
@@ -52,6 +54,7 @@
   "openPluginEditor",
   "probeDeviceOptions",
   "pushRendererAudio",
+  "releaseMonitorMuteHold",
   "removeProcessor",
   "removeSource",
   "replaceIR",