fix: harden multi-output recovery

[pantafive]

Summary

• route to a verified live fallback before destroying the current system-default aggregate
• retain failed aggregate IDs and retry cleanup instead of forgetting public HAL objects
• check aggregate liveness and rebuild after device republish
• refresh member AudioObjectIDs by stable UID and replace stale volume listeners
• make leftover cleanup conservative when HAL reads fail
• add regression tests for republished and disappeared members

Why

The previous teardown ignored route and destroy failures. During Bluetooth loss, wake, or HAL churn it could delete the current default without establishing a replacement, or leave a public aggregate behind while the controller believed cleanup had succeeded.

Verification

• make test: 54 tests passed
• Swift 6 strict-concurrency application build passed
• SwiftFormat and SwiftLint passed