refactor(core): extract session model request preparation

[kitlangton]

What

Extract provider-request preparation from SessionRunnerLLM into a Location-scoped SessionModelRequest module.

The runner now owns durable orchestration only: instruction sync, pending promotion, compaction, provider streaming, durable publication, retries, and tool settlement. SessionModelRequest.prepare owns the complete model-request shape: system and history messages, selected model headers, prompt-cache identity, tool definitions, Step limits, and Session context hooks.

This is the next behavior-preserving slice toward transient session.generate; it adds no public operation yet.

How

• packages/core/src/session/model-request.ts prepares one canonical LLMRequest from SessionContext.Loaded.
• Request preparation captures executable tools and exposes a narrow resolveToolCall(name) capability, so the runner does not reconstruct hook-removal or Step-limit policy.
• Context hooks run before the final LLM.request normalization, avoiding the previous construct-then-reconstruct pass while preserving the same canonical hook values.
• Hooked tool definitions are rebuilt in one pass. Definitions removed by hooks remain privately indexed so generated calls to them are rejected before settlement.
• plans/session-generate.md uses the same outbound model-request vocabulary.
• packages/core/src/session/runner/llm.ts delegates preparation and otherwise preserves its existing provider-event and durability flow.

Three simplify passes reviewed reuse, interface depth, behavioral equivalence, and hot-path allocations. The final pass removed the speculative one-case operation wrapper, hook-removal runner branches, duplicate history copies, duplicate request normalization, and redundant blocked-tool state.

Scope

This PR does not add session.generate, alter Session context selection, change instruction persistence, initiate transient compaction, or expose a public/plugin/API surface.

The first operation remains a durable Step. A later caller can add transient generation behind the same module once read-only instruction assembly and revisioned Session snapshots are available.

Testing

• bun typecheck in packages/core
• bun run test in packages/core: 1,313 passed, 6 skipped
• bun run test session-runner.test.ts session-runner-recorded.test.ts session-runner-tool-registry.test.ts plugin-hooks.test.ts: 146 passed
• bunx prettier --check packages/core/src/session/model-request.ts packages/core/src/session/context.ts packages/core/src/session/runner/llm.ts plans/session-generate.md
• bunx ast-grep scan -c script/ast-grep/sgconfig.yml packages/core/src/session/model-request.ts packages/core/src/session/context.ts packages/core/src/session/runner/llm.ts
• Changed-file Oxlint: no findings in session/model-request.ts; two pre-existing warnings remain in unchanged manual-compaction code in session/runner/llm.ts
• Repository pre-push typecheck: 32 packages passed

Flow

sequenceDiagram
    participant Runner as SessionRunner
    participant Request as SessionModelRequest
    participant Hooks as Session context hooks
    participant LLM as LLMClient
    participant Tools as Tool settlement

    Runner->>Request: prepare(context, step)
    Request->>Hooks: transform system, messages, tools
    Hooks-->>Request: mutated request draft
    Request-->>Runner: request + tool-call capability
    Runner->>LLM: stream(request)
    LLM-->>Runner: LLM events
    Runner->>Request: resolveToolCall(name)
    Request-->>Runner: reject or settle capability
    Runner->>Tools: settle(call)

Loading