fix: collapse duplicate debuggerSession state to single source

[ERoydev]

• Drop the module-level debuggerSession mirror in extension.js; route reads through getDebuggerSession() so sessionManager is the single source of truth
• Set tcpPort on the session before publishing via setDebuggerSession() — consumers never see a half-built session
• Simplify cleanupDebuggerSession() to a single clearDebuggerSession() call