fix: add in-memory _bootFired flag to runBoot as primary dedup guard

sessionStorage alone could be bypassed in hash-URL edge cases. A module-scoped
_bootFired flag blocks any second runBoot call within the same JS context
regardless of sessionStorage state, then sessionStorage handles cross-reload
suppression. Also restores boot call in private init() to preserve original
dual-path structure.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

base.js

@@ -312,10 +312,13 @@
      lt.boot.run('APP NAME')
      lt.boot.run('APP NAME', true)   // force replay
      ---------------------------------------------------------------- */
+  let _bootFired = false; // in-memory guard: survives within a JS context, resets on true page reload
   function runBoot(appName, force) {
+    if (!force && _bootFired) return;   // Fastest guard — blocks any same-page double-call
     const storageKey = 'lt_booted_' + (appName || 'app');
     if (!force && sessionStorage.getItem(storageKey)) return;
-    sessionStorage.setItem(storageKey, '1'); // Claim the run immediately to block double-init
+    _bootFired = true;
+    sessionStorage.setItem(storageKey, '1');
     const overlay = document.getElementById('lt-boot');
     const pre     = document.getElementById('lt-boot-text');
     if (!overlay || !pre) return;
@@ -1333,7 +1336,9 @@
     /* v1.3 */
     initMobileNav();
     initSidebarSubmenus();
-    /* Boot is handled exclusively by lt.init() or lt.boot.run() to avoid double-init */
+    /* Boot */
+    const bootEl = document.getElementById('lt-boot');
+    if (bootEl) runBoot(bootEl.dataset.appName || document.title);
   }
 
   if (document.readyState === 'loading') {