fix(downloads): harden lifecycle race handling

Audit Assignment 06 lifecycle paths and preserve truthful state across ambiguous Aria2 resume failures. Clean up partial startup listener registration and prevent stale resume workers from leaking or releasing current permits.

src-tauri/tests/queue_manager.rs

@@ -227,6 +227,24 @@ async fn ensure_aria2_permit_does_not_double_acquire() {
     assert_eq!(mgr.available_permits(), 2);
 }
 
+#[tokio::test]
+async fn stale_aria2_permit_candidate_cannot_replace_current_permit() {
+    let (mgr, _spawner) = make_manager(2);
+    let existing = mgr.acquire_permit().await.unwrap();
+    assert!(mgr
+        .park_aria2_permit_if_missing("a", existing)
+        .await);
+
+    let candidate = mgr.acquire_aria2_permit_candidate().await.unwrap();
+    assert!(!mgr
+        .park_aria2_permit_if_missing("a", candidate)
+        .await);
+    assert_eq!(mgr.available_permits(), 1);
+
+    mgr.release_permit("a").await;
+    assert_eq!(mgr.available_permits(), 2);
+}
+
 #[tokio::test]
 async fn aria2_control_epoch_invalidates_stale_resume_workers() {
     let (mgr, _spawner) = make_manager(1);