feat(runtime-host): own derived Session effects

[M4n5ter]

English

Summary

• Move tool-free Session title and recap generation behind Runtime Host ownership, using the Session's canonical model connection, credentials, proxy policy, and Usage authority.
• Add a typed, bounded session.recap.generate Client operation with durable intent/result evidence so concurrent Clients and exact retries share one outcome without repeating provider work.
• Integrate derived effects with Host drain, deadlines, transport cleanup, Session retirement fencing, and strict Usage persistence.
• Share the title/recap prompt and cleanup helpers with the existing embedded Runtime path without wiring a production Desktop or TUI adapter in this slice.

Contract

• The Host admits only a short Session snapshot-and-intent phase; provider I/O does not hold the Session lane.
• Exact retries replay terminal evidence, join same-process work, or return outcome_unknown when provider/accounting completion cannot be proven.
• Active title and recap work blocks Session archive/removal and is aborted during Host drain.
• Configuration, provider, cancellation, timeout, and local persistence failures remain distinct; local authority or accounting uncertainty never becomes a false terminal result.
• The Runtime Host wire protocol remains v0.

Validation

• Runtime and Runtime Host full test suites
• Core and CLI full test suites
• Repository format and lint checks
• Core, Runtime, Runtime Host, and CLI type checks

Part of #1167.

中文

概要

• 将无工具 Session 标题与 recap 生成收归 Runtime Host，并统一使用 Session 的规范模型连接、凭据、代理策略和 Usage authority。
• 新增类型化、受边界约束的 session.recap.generate Client 操作，以持久化 intent/result 证据保证并发 Client 与精确重试共享同一结果，避免重复调用 provider。
• 将派生效果纳入 Host drain、截止时间、传输清理、Session retirement fence 和严格 Usage 持久化。
• 标题与 recap 的 prompt/清理逻辑由现有 embedded Runtime 路径复用；本 slice 不接入生产 Desktop 或 TUI adapter。

契约

• Host 只在短暂的 Session 快照与 intent 阶段持有 admission；provider I/O 不占用 Session lane。
• 精确重试会重放 terminal 证据、加入同进程工作，或在无法证明 provider/accounting 完成状态时返回 outcome_unknown。
• 活跃的标题或 recap 工作会阻止 Session 归档/删除，并在 Host drain 时终止。
• 配置、provider、取消、超时与本地持久化失败保持可区分；本地 authority 或 accounting 不确定性不会被写成虚假的 terminal 结果。
• Runtime Host wire protocol 继续保持 v0。

验证

• Runtime 与 Runtime Host 全量测试
• Core 与 CLI 全量测试
• 仓库格式与 lint 检查
• Core、Runtime、Runtime Host 与 CLI 类型检查

属于 #1167 的一部分。