refactor(runtime): converge desktop session lifecycle

[limityan]

Summary

This refactor establishes a framework-neutral Desktop session application boundary and turns the existing Tauri commands into transport adapters for the selected session lifecycle. Stable lifecycle operations now flow through the Agent Runtime SDK, while rich Desktop-only persistence views remain behind one Core compatibility facade.

The change also adds narrowly typed, additive support for explicit archive state and exact-turn fork operations. Existing latest-turn fork behavior, request shapes, provider compatibility, and Core ownership remain intact.

Why

Desktop session commands had accumulated direct access to persistence, coordinator, scheduler, ACP, relay synchronization, remote workspace lookup, and Tauri state. That coupling made behavior equivalence hard to review and made the session lifecycle difficult to reuse safely from GUI, CLI/TUI, headless, remote, and SDK surfaces.

This PR converges the current production behavior behind a Desktop-owned application service without claiming a universal product profile or moving concrete lifecycle ownership out of Core. It reduces framework coupling while retaining the existing compatibility paths that still carry Desktop-specific views and persistence semantics.

Product and compatibility behavior

• Preserves existing Desktop command wire shapes and error projections.
• Preserves local, remote, unresolved-remote, and offline saved-host session identity, including access to history after a local workspace is deleted or temporarily unavailable.
• Keeps legacy latest-turn fork local-only; exact-turn fork uses a separate additive request and supports the remote identity required by the existing Desktop flow.
• Keeps archive-only providers source compatible through default trait behavior, while enabling explicit unarchive for providers that implement the new operation.
• Preserves ACP release, durable deletion, and relay tombstone ordering, including failure short-circuit behavior.
• Preserves command-level restore tracing so storage-path resolution remains observable even when the later restore phase fails.
• Keeps Core-authoritative metadata isolated from the UI-owned metadata whitelist.
• Introduces no account concept into the application service or shared session contracts; existing account, peer, and relay ownership remains unchanged.

Scope boundaries

Included in this PR are the existing Desktop session history and lifecycle flows: listing, paging, archived views, restore variants, metadata reads and UI-owned updates, usage reporting, rename, ensure-loaded, exact-turn fork, explicit archive state, and single-session deletion.

The PR intentionally does not absorb session creation, compaction, Thread Goal behavior, raw turn writes, transcript export, bulk archive/delete, extension execution, product customization, or a complete Desktop delivery profile. It also does not add a service locator, generic command bus, or parallel session owner.

Architecture and stability

• Product logic remains below Tauri, while Desktop-specific host effects stay in a dedicated runtime adapter.
• Core remains the concrete owner of sessions, persistence, scheduler coordination, and lifecycle execution.
• Shared contracts remain behavior-light and additive.
• Resolved storage paths are passed through the narrow runtime surface so Desktop retains its established history-access semantics without weakening the stricter shared workspace resolver.
• The session surface builder reuses existing Core owners and does not assemble unrelated runtime services or harness registries.

Independent review

A separate senior architecture and product-design review was performed over the complete diff. The review initially blocked on four issues: latest-turn fork path misuse, deleted-workspace history compatibility, an application-to-host adapter dependency inversion, and restore trace timing. All four were fixed, covered by focused regressions, and independently re-reviewed. Final result: APPROVE with no remaining architecture, product-semantics, or compatibility blockers.

Verification

• cargo check --workspace
• cargo test -p bitfun-core product_runtime::tests:: --lib -- --nocapture (15 passed)
• cargo test -p bitfun-desktop runtime::session_application::tests:: --lib -- --nocapture (9 passed)
• cargo test -p bitfun-desktop runtime::tests:: --lib -- --nocapture (2 passed)
• cargo test -p bitfun-runtime-ports (all unit, integration, and doc tests passed)
• cargo test -p bitfun-agent-runtime --test session_operation_ports (2 passed)
• node scripts/check-core-boundaries.mjs
• git diff --check