feat(session): unify agent behaviors and host-last checkpoints

[wolfy-j]

Session consumes registered trait data.behaviors alongside existing lifecycle and checkpoint bindings. The shared controller handles activation, agent switches, same-ID trait-overlay changes, and finish. Session owns phase payloads, message insertion, checkpoint scheduling/fallback, and strict-failure handling.

A missing stored active object cannot be replaced with a different current agent, model, or trait variant. Unavailable or mismatched recovery fails without dispatching a wrong deactivate hook or silently clearing the old state. Same-identity refresh remains supported.

Checkpoint precedence is intentionally host-last: trait defaults, explicit agent_options.checkpoint, persisted session configuration. Existing flattened session threshold/function fields override agent values; optional persisted config.checkpoint overlays last. This does not add checkpoint settings to start tokens or _control.config. Explicit disabling and the existing strict > / nonpositive-threshold rules are preserved. Scheduling uses normalized full context size, including cached input.

Each queued checkpoint captures detached effective options and the selected function. Later configuration changes cannot rewrite that operation. Bindings run before the function fallback, with the same effective options; a strict binding error prevents fallback and checkpoint-state writes.

Earlier validation on v0.3.44a with local Framework #144 sources: 351 session tests passed; lint passed. Tests cover precedence, disabling, stable dispatch, binding/function fallback, strict failures without writes, lifecycle transitions and missing-object recovery, cross-owner denial, and canonical read-policy enforcement through run-context contract dispatch. The wrong-agent fallback and silently-lost-state cases failed before their fix. Existing memory recall behavior is unchanged.

Release gate: depends on Framework #144's lifecycle_controller and checkpoint_runtime.resolve_options. The currently declared/locked wippy/agent 0.5.0 lacks them. Before merge, publish only the changed agent module, raise the dependency floor to its first published version, regenerate both locks, then verify the actual published package and CI. Local source overlays are not proof of that release gate. Keep this PR draft; no merge or publication has been performed.

Durable controls and mixed-boundary hardening (October 2)

Framework #144 is now merged. This host draft now persists the opt-in declarative behavior controls with the response/tool intents, waits for outcomes to settle before applying them, and replays pending proposals without rerunning tools or dispatching another model step. Already-committed configuration targets are skipped on replay. Checkpoint summary, anchor, audit metadata and compact-request consumption commit atomically under the canonical writer metadata lock; failed writes retain usable history.

Two test-first regressions exposed stale pre-control checkpoint settings: after both a tool round and a final text answer, a model/provider change plus compact request could capture the old target. Requested compaction now captures the committed configuration. Combined handler/prompt tests admit steering between two tools, require both outcomes before controls, and prove ordered input appears once with one continuation. Stop cancels proposals and retains input. Canonical agent handoff ends the old turn, retaining accepted input and compact requests for the next user turn without automatically dispatching the replacement.

Latest local verification on v0.3.44a and Framework 7b0ae91: 370/370 Session tests, clean lint across 177 entries, whitespace checks pass. These tests combine production handlers and prompt construction with deterministic fixtures; they are not a new live-LLM or whole-runtime crash proof. Earlier real-database transaction/rollback tests are included in the full suite. The latest combined host changes still need PostgreSQL/full-runtime restart sign-off and actual published-dependency verification before merge. Remains draft; no module publication or release performed.