feat(remote): client-side /acp liveness — heartbeat, resume, turn recovery

[brettchien]

Wires the four Studio-side fixes from the /acp zombie/RST investigation. All four surface as app-log lines so they're readable in the Activity panel.

Context

Symptoms seen in the field: repeated remote: ws read: WebSocket protocol error: Connection reset without closing handshake every few minutes, and an Orca session that only cleared after bouncing the ECS task. Root cause is a silent idle socket with no client-side liveness. This PR is the client half.

What changed

src-tauri/src/remote.rs — run_reconnecting now owns a persistent Session; run_once gains a liveness timer and threads its exit reason out through an outcome so every exit path runs cleanup.

1. Idle heartbeat (item 1). A tokio::time::interval arm probes an idle socket with studio/ping — a method the gateway answers itself with -32601 (no agent turn, no tokens, answered even mid-prompt). Any inbound frame = liveness; a probe unanswered for a full interval ⇒ half-open ⇒ reconnect. Also keeps the socket warm, so the idle-RST churn stops at its source.
2. session/resume on reconnect (item 2). The Session persists across attempts; a reconnect resumes the existing agent session instead of stacking a fresh session/new each time. If the gateway already reaped it, the resume error falls back to session/new.
3. Abandoned-turn notice (item 3). When the socket ends with a turn in flight, it's recorded in Activity (the chat panel already closes the spinner off remote-status, so this is the observability half).
4. Turn ceiling (item 4). A session/prompt with no result past PROMPT_TIMEOUT (600s) invalidates the socket and reconnects rather than trusting a wedged peer — ADR browser-tunnel-liveness R3.

crates/acp-tunnel/src/lib.rs — adds Session::heartbeat() (the probe builder) and Session::forget_session() (resume→new fallback), each with a unit test.

New Activity log lines

• remote: reconnecting — will resume the existing session (info)
• remote: session resumed — oab tools republished (info)
• remote: session/resume rejected (…) — opening a fresh session (warn)
• remote: liveness probe unanswered — socket half-open, reconnecting (warn)
• remote: turn exceeded 600s with no result — dropping the socket and reconnecting (warn)
• remote: connection dropped with a turn in flight — turn abandoned (warn)

Tests

cargo test -p acp-tunnel → 25 passed. studio-desktop compiles on the macOS desktop job (the Linux compile-gate is disabled and this box lacks the GTK/WebKit stack); remote.rs was rustc-parse-checked here (no syntax/type errors in reach).

Not in this PR (server side — needs your go)

This is the client half. The seat-burning zombie — an orphaned agent turn on a half-open socket the gateway can't detect — still needs, in openabdev/openab crates/openab-gateway: (a) server-initiated liveness (WS ping / read-idle timeout so the read loop actually breaks), and (b) firing each session's cancel Notify on teardown, not just abort()ing the relay task. I'll open that as a separate openab issue for review before touching it.

🤖 Generated with Claude Code