fix: surface ZCode progress and cancel foreground jobs

[vitry]

Summary

• stream safe, bounded ZCode activity to foreground stderr with a 20-second heartbeat and durable status previews
• persist and render job phase/activity while bounding protocol, memory, terminal-injection, and lifecycle races
• make SIGINT/SIGTERM stop the exact persisted ZCode session across delegated jobs and Transfer, including authorization and status-wait boundaries
• document foreground/background cancellation semantics without changing the 0.1.0 package version

Test plan

• npm run check
• npm run test:qualified (2 authenticated real-E2E cases reported their documented opt-in skips)
• git diff --check 82182b3...HEAD
• independent full-branch spec review
• independent full-branch code-quality review

Known minor follow-ups

• failed private result-artifact cleanup can leave an unreachable file in the private plugin data root
• a pre-send session whose stop also fails has only owner/session cleanup, not a durable per-job cleanup diagnostic