T3: AppSession composition root and AppState

[Jon-Gear]

Parent

Restructure spec: #13 (RESTRUCTURE_PLAN.md)

What to build

The session autoload that owns configuration resolution, the AppState bundle (game session, brothers, wave, flow, and a case-insensitive flags sub-state), construction of every service, and build/reset semantics. A reserve seam is left where FlowController plugs in later. Verifiable by tests that construct an isolated AppState fixture.

Acceptance criteria

• AppSession is the single construction point for services; missing configuration fails loudly at startup
• AppState exists as typed sub-states with to_dict/from_dict serialization
• build_runtime and reset_runtime_state are verified by tests on an isolated AppState
• Existing autoloads and scenes still run alongside the session

Blocked by

• T1 Foundation: layers + vocabulary + ADRs (T1: Foundation - five-layer scaffolding, domain vocabulary, recorded decisions #14)
• T2 Test harness with first reference tests (T2: Test harness with first reference tests #15)