fix(ext/setup): lock verified handle on Step 5 error + early-return paths

Mirrors Step 3b's discipline. Previously, if save_setup failed or addDevice
threw, state.verifiedHandle (the WASM session from Step 3b) would remain
in linear memory until tab close. Now lock+null on every exit path.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

extension/src/setup/setup.ts

@@ -1142,7 +1142,14 @@ function attachStep5(): void {
           },
         );
       });
-      if (!saveOk) { render(); return; }
+      if (!saveOk) {
+        if (state.verifiedHandle !== null) {
+          try { w.lock(state.verifiedHandle); } catch { /* best effort */ }
+          state.verifiedHandle = null;
+        }
+        render();
+        return;
+      }
 
       // 3) Register device on the remote (read-modify-write devices.json).
       const hostUrl = state.hostType === 'github' ? 'https://api.github.com' : state.hostUrl;
@@ -1164,6 +1171,10 @@ function attachStep5(): void {
     } catch (err: unknown) {
       console.error('[relicario setup] register device failed:', err);
       state.error = `Failed to register device: ${err instanceof Error ? err.message : String(err)}`;
+      if (state.verifiedHandle !== null) {
+        try { (await loadWasm()).lock(state.verifiedHandle); } catch { /* best effort */ }
+        state.verifiedHandle = null;
+      }
       render();
     }
   });