Delete dialog never detects the loaded model since the argv-derived session signature

[Helldez]

The delete dialog's "this model is loaded" guard never fires. ModelPickerUi.kt:268 detects the loaded model by assuming the session signature starts with the model path:

val isLoaded = copies.any { loadedSig != null && loadedSig.startsWith(it.absolutePath + "|") }

That was true of the old hand-written signature. Since #151, AppSettings.sessionSignature is derived from the argv:

sessionArgv(cliPath = "", modelPath = modelPath, csvPath = null).joinToString("|")

argv is [cliPath, "-m", modelPath, ...] with cliPath = "", so the signature is |-m|<path>|-t|... — it starts with |-m|, not with the path. startsWith is always false, for every model.

Effect: isLoaded is always false. The delete dialog never warns that the model is loaded and Delete stays enabled, so the user can unlink the gguf a live engine has mmapped: the model vanishes from the picker, disk space is not reclaimed until unload, and the engine keeps running on a file that no longer exists.

Fix options:

• Minimal: match the new format — loadedSig.contains("|-m|" + it.absolutePath + "|") (the path is unambiguous right after the -m token).
• Cleaner: stop parsing the signature for this at all and have RunBus expose the loaded model path as its own field. The signature exists for warm-reuse identity, not for path extraction; any future argv change silently breaks a string match again.

The stale comment on ModelPickerUi.kt:266-267 ("sessionSignature starts with the model's path") should go with the fix either way.