feat: add durable ManagedSessions

[wms2537]

Closes #51

Outcome

Adds the first real kertas.runtime/v1alpha1 ManagedSession slice without importing Kertas Project state into the runtime.

• tenant/principal-scoped idempotent session creation and cancellation
• one active top-level Run per session with child/replacement membership
• atomic, crash-safe cancellation of every nonterminal session Run and Attempt
• session state projection distinct from Run/Kertas Outcome/Release semantics
• historical migration leaves existing Runs unassigned
• cross-tenant agent-version and resource invariants enforced in store and database
• published partial/planned ManagedSession schemas while run-as-session/v1 remains wire-compatible

Verification

• exact commit: 6ede399bb288e14a5c6afcb34f027a69b57aaa23
• controlled-alpha release gate: PASS
• evidence: release-evidence/2026-07-22T07-28-10-696Z
• independent spec review: PASS
• independent standards/concurrency review: PASS
• targeted migration, API, compatibility, replay-burst, rollback, follow-on admission, and delegated-lineage tests: PASS

The target contract remains planned until #52 supplies authenticated ordered inbound events.