fix(runtime): land the terminal fact a stop claims, and stop dropping non-terminal prior runs

[Astro-Han]

Summary

A run stopped while parked on AskUserQuestion left the Session projection saying "aborted" and the RuntimeEvent ledger saying nothing at all. Its header stayed waiting_for_user forever, and every later turn then dropped that whole turn — user message, assistant text, all tool activity — from the model's context. The agent read as amnesiac, permanently, because the header never becomes terminal on its own.

Two changes, one at the source and one at the amplifier:

• stop lands the terminal fact it already claimed. stop() takes the Run's terminal claim, but only finalize() — reached when the backend's event stream ends — ever cashed it, and a turn parked on an unanswered interaction never ends that stream. The claim is now cashed where the stop completes, and the stop is fail-closed: a settlement that cannot land makes the stop fail rather than report a success it did not establish, and leaves the operation pending so a retry settles it again. The claim keeps the write idempotent — a stream that later produces its own terminal event finds it taken and writes nothing.
• Prior-run context stops silently deleting a run. buildPriorRuntimeContext treated a non-terminal prior run as skippable. It now replays whatever ledger that run does have; only the effective run header still depends on a terminal fact. No repair is attempted on this branch — repairRunTerminalFact returns false for a non-terminal header before reading anything, so the call could only ever answer "no".

Either change alone leaves the defect reachable: the first does not help runs already stranded (a crash, an older build), and the second leaves stop reporting a success it did not establish.

Scope: embedded owners. A Hosted Run's terminal fact belongs to the Host's terminal authority (#1359, #1996), which also parks provider-indeterminate Runs that a stop must not resolve on their behalf.

Refs #2074

Verification

• @maka/runtime — 3096 pass, 0 fail (9 skipped), including six new behavior tests: a stop whose backend stream never ends commits a terminal fact; a prior run left non-terminal by an unanswered interaction is replayed into model context; a settlement racing finalize commits exactly one terminal run event; a stop whose settlement fails stays retryable; a hosted stop leaves the terminal fact to the Host; a settlement finds an already sealed ledger and leaves it untouched. Each was confirmed red against the code without its guard first.
• @maka/runtime-host — 619 pass, 0 fail. This suite caught two real regressions from an earlier, wider version of the fix (a sealed-ledger append and a parked continuation being resolved by shutdown); both shaped the final scope.
• @maka/headless — 1338 pass (1 skipped). maka-agent (CLI/TUI) — 468 pass.
• npm run build (full workspace tsc), npm run lint, npm run format:check — clean.
• Not run: Desktop E2E and Storybook. No renderer, IPC, or UI surface changes.

Root cause

Confirmed against a real Desktop store, not inferred. Across 157 runs, exactly 5 were non-terminal, and all 5 held an AskUserQuestion function_call with no matching function_response. For one of them the session-message layer was complete — turn_state{status:aborted, abortSource:renderer.stop_button} and an error tool_result — while the ledger held text×4, function_call×8, tool_dispatch×8, function_response×7 and no terminal event. The next run started 22s later and was built without any of it. Full evidence in #2074.