feat: add internal Session CLI collaboration

[baixiaohang]

Summary

• replace the source-side internal Session hosted tools with opentag session create, send, and bounded list commands
• authenticate those commands with stable runtime-managed proof bindings, lifecycle-fenced dispatch admission, and target SessionMessage FIFO delivery
• inject role-aware visible/internal Session instructions and share normal Agent runtime capabilities without exposing IM delivery credentials to internal Sessions
• add index-backed direct/recursive cursor pagination, proof and descendant-activity migrations, protocol v2 negotiation, tests, and synchronized English/Chinese documentation

Breaking behavior

• removes create_internal_session and send_session_message hosted tools and the source collaboration protocol frames; clients and servers must negotiate runtime.sessionCollaboration v2
• does not expose an Agent-facing end command; existing administrative lifecycle invalidation and sessions.ended_at storage remain
• Session collaboration now requires an OpenTag-launched runtime with OPENTAG_SESSION_PROOF_FILE; there is no user-token or caller-identity fallback
• Provider processes launched by one daemon OS user remain one trust domain; proof files are not a security boundary against compromised sibling Sessions until per-Session OS/container isolation exists

Validation

• pnpm check
• pnpm build
• pnpm typecheck
• pnpm test (all 7 tasks; Server 271, Client 472, CLI 126, and Web 325 tests)
• pnpm --filter @opentag/client test:agent-runtime:coverage (20 files, 288 tests; 100% statements, branches, functions, and lines)
• pnpm --filter @opentag/server test:integration (11 files, 194 tests)

Non-goals

• no Web create/send/retry controls or Task state machine
• no retention policy or automatic Session cleanup
• no per-Session tools, MCP, repository, or workspace allowlists
• no cross-Agent Session messaging
• no per-Session OS user or container isolation
• no multi-replica Server owner routing; Session CLI proof authentication and Runtime delivery require the current single-replica deployment model

[yuezengwu]

Reviewed exact head d5820ca5232288c6e42dbd5738f308f6db36a589.

Blocking: the source Runtime binding is validated only at HTTP authentication / initial message recording, not at either final Runtime dispatch admission. SessionCliProofService.authenticate checks the source workspace placement generation and connection instance, but AuthorizedSessionMessageRoute retains only sourceSessionId. After runtime assembly or reconcile waits, withCollaborationDispatchAdmission rechecks that the source Session is unended while it validates only the target placement generation. Therefore a source placement move/generation advance or source connection replacement committed in that window does not fence the subsequent reconcile or SessionMessage frame.

That contradicts the collaboration proof contract (placement/connection changes invalidate the binding) and the shared runtime model that placement generations and current connection instances fence stale execution. Please carry the source workspace/generation/connection authority through the route and revalidate it at both ready and delivery admission boundaries. Add integration races for a source placement move and source connection replacement between initial authorization and each dispatch.

Current status also requires a fresh head before approval: this head is CONFLICTING/DIRTY against current main (971b7c3db073f9028c3f14f7ab50b74f1c228ca6), and GitHub CI is red from the IM-binding integration test. I could not reproduce that test failure locally: pnpm check, pnpm build, pnpm typecheck, pnpm test, agent-runtime coverage (100%), and the full 176-test server integration suite all passed.

[baixiaohang]

Addressed the exact-head blocker and merged current main without rebasing or force-pushing.

• The proof-authenticated source workspace, placement generation, and connection instance now remain on the authorized route.
• Both ready reconcile and SessionMessage delivery independently lock and revalidate the source and target authority before dispatch.
• Added four PostgreSQL race regressions for source placement moves and connection replacement before ready and between ready/message dispatch.
• Preserved main migration 0020_large_jack_power and moved the collaboration migration to 0021_odd_liz_osborn.

Local validation on head 4ca122f passed: pnpm check, pnpm build, pnpm typecheck, full pnpm test, 194 Server integration tests, and Client Agent Runtime coverage at 100% across statements, branches, functions, and lines. Exact-head CI is running.

[yuezengwu]

Reviewed exact head 4ca122feb49c656016661bf565c09c5a1ea84369.

The previous source-authority blocker is resolved: the authorized route now retains source workspace, placement generation, and connection instance, and both ready reconcile and SessionMessage delivery independently re-lock and revalidate source and target authority at the dispatch boundary. The four PostgreSQL race regressions cover source placement movement and connection replacement both before ready and between ready/message frames, and their frame assertions would fail without the new fences.

I also verified the merge resolution preserves current main migration 0020_large_jack_power and restacks collaboration storage as 0021_odd_liz_osborn; the journal, snapshots, schema, and migration tests agree. git diff --check is clean and all 6 exact-head CI checks pass.

Fresh local validation passed: pnpm check, pnpm build, pnpm typecheck, full pnpm test, Client Agent Runtime coverage (20 files / 288 tests, 100% statements, branches, functions, and lines), and Server integration (11 files / 194 tests).