feat: process session events as durable causal runs

[yanpgwang]

Summary

• atomically admit one durable run per processable trigger event
• persist each completed run's output event IDs and reconstruct model history in causal turn order
• keep public event history in immutable receipt/commit order
• prevent terminated sessions from reclaiming queued work
• detach and bound sandbox teardown from request cancellation
• document the remaining pending-action gating limitation

Validation

• go test ./...
• go test -race ./...
• go vet ./...
• git diff --check
• critical store/app tests repeated 20 times under the race detector