Keep the chat session when /ctx fails to recreate it

[superbling]

Summary

repl_chat_set_ctx() freed the existing session before trying to create the replacement:

static int repl_chat_set_ctx(ds4_engine *engine, repl_chat *chat, int ctx_size) {
    ds4_session_free(chat->session);
    chat->session = NULL;
    chat->ctx_size = 0;
    return repl_chat_create_session(engine, chat, ctx_size);
}

If the new session failed to allocate (e.g. asking for a context size the backend can't satisfy), the old session was already gone and run_repl had no choice but to break out of the loop, ending the chat.

This PR drops the redundant pre-free. repl_chat_create_session() already has the safe ordering — it tries to create first and only frees the old session on success — so removing the pre-free restores that protection. The /ctx handler is updated to print a warning and keep the current context on failure rather than exiting the REPL.

Heads up: behavioral change

This is not pure cleanup — it changes user-visible behavior:

• Before: /ctx N with a valid number that fails to allocate terminates the REPL.
• After: prints ds4: /ctx N failed; keeping current ctx M and stays at the prompt.

I think keeping the session is the friendlier default (matches every other REPL failure path), but this is a design call and I'm happy to drop the run_repl change if you'd rather keep the terminate-on-failure semantics. The repl_chat_set_ctx() cleanup still stands on its own — it's a real bug regardless of how the caller responds.

Relation to #54

Independent of #54. Both touch the /ctx handler so they will textually conflict on whichever lands second; happy to rebase. The two PRs address different failure modes:

• Don't kill the REPL on /ctx with invalid input #54 — /ctx abc (parse error)
• this PR — /ctx N where N is valid but creation fails (resource error)

Test plan

• make — clean build, no new warnings
• Piped /ctx 4096 then /quit into ./ds4 -c 4096: session recreated successfully, exits cleanly. The failure path is hard to exercise reliably without injecting an allocation failure into ds4_session_create(); relying on inspection for that branch.