Version work for the host-lifetime and dual-era commits that precede this
one. Three packages move together, and the reason is the point:

romdev-core-host 0.7.2 -> 0.8.0. dispose() is a new public method, so
this cannot ship as a patch — and 0.7.2 is already on the registry.
Publishing romdevtools while still pinning 0.7.2 would have shipped a
server whose eviction path calls a method the published core-host does not
have: teardown would fall back to unloadMedia() and the leak would return
for every npm user while passing every test in this tree. That is the
whole hazard the exact pins exist to prevent, and it is invisible unless
you check the registry rather than the workspace.

romdev-core-runner 0.2.11 and the romdevtools repin follow from it. The
workspace-contract test walked the chain: it failed on core-runner's stale
pin, then on romdevtools' stale pin to core-runner, one hop at a time
until the graph was consistent. Working as designed.

Verified by packing rather than by reading: the romdev-core-host tarball
actually contains dispose(). A version bump that does not carry the code
is the same outage as no bump at all.

Also noted while rehearsing, NOT caused by this change:
internal-romdev/publish-all.mjs is broken independently. It resolves
packages/ relative to its own directory (it predates the split into
internal-romdev/) and it asserts "exactly one non-wasm package", which has
been false since 0.84.1 extracted romdev-audio-resampler — there are eight
now. Each package dry-runs clean individually; the orchestrator needs
fixing before it can drive a release again.