Refactor session ownership, turn cancellation, and tool execution

[stippi]

Summary

Implements three incremental architecture improvements, with regression tests written and run red before the corresponding fixes.

1. Session state ownership and canonical conversation

• Make the conversation tree authoritative; keep prompt recovery/compaction adjustments in a separate projection rather than deleting canonical evidence.
• Preserve formatted tool inputs and response corrections across persistence round-trips.
• Stop agent checkpoints from overwriting session-owned settings with stale run configuration.
• Add a per-session locked read–modify–write boundary for settings and checkpoints.

2. Turn lifecycle and cancellation

• Introduce bounded per-session command lanes, independent slow-I/O dispatch, and a separate control mailbox.
• Reserve a run before asynchronous preparation, without holding the shared manager lock across the SessionService MCP/LLM preparation path.
• Tie cancellation and TurnHandle cancellation to the specific run; wake provider and permission waits even when no streaming chunks arrive.
• Preserve newer model selections during preparation and reject externally locked starts before appending a message.
• Use owned cleanup guards for preparation, cancellation registrations, and sleep inhibition.

3. Tool execution and recovery

• Share mandatory scope/permission checks and completion handling between sequential, parallel, and intercepted calls.
• Run completion hooks and preserve modified inputs for parallel calls; retain sequential ordering barriers.
• Journal unstarted/uncertain invocations and persist completed results individually, without waiting for the whole batch.
• Stop further dispatch on persistence failure; do not let UI publication failures erase completed tool evidence.
• Finalize sub-agent errors/cancellation with structured output, preserve completed child-tool evidence and usage, and unregister on errors, panics, and task drops.
• Fix a separately reproduced streaming panic on empty tool input ({}).

Review order

1. 4bb7282c — canonical conversation and session-owned checkpoint boundaries
2. ca6b02e6 — run preparation, command lanes, and cancellation
3. 9ff102f8 — shared tool pipeline and individual outcome journal
4. aecda236 — empty JSON input streaming fix
5. 35916ad3 — sub-agent finalization, cleanup, and cancellation propagation

Validation

Locally verified on macOS, without the document-conversion feature:

• 700 tests passed, 2 ignored across tools_core, agent_core, code_assistant_core, and mcp_client.
• Clippy for those crates, all targets, with -D warnings: passed.
• Test compilation with GPUI, terminal, ACP, and MCP-server frontends enabled: passed.
• Formatting and git diff --check: passed.

Commands:

cargo test --locked --offline --no-default-features -p tools_core -p agent_core -p code_assistant_core -p mcp_client --lib -- --test-threads=1
cargo clippy --locked --offline --no-default-features -p tools_core -p agent_core -p code_assistant_core -p mcp_client --all-targets -- -D warnings
cargo check --locked --offline -p code-assistant --no-default-features --features gpui-frontend,acp-frontend,terminal-frontend,mcp-server --tests
cargo fmt --all -- --check
git diff --check

Scope and limitations

• read-only / outward classification semantics are unchanged.
• Persistence remains JSON-snapshot-based; this is not an event-sourcing/database migration or a general revision/CAS protocol. Legacy full-replacement APIs remain.
• Unknown external side effects are not automatically retried. A local checkpoint cannot guarantee exactly-once execution for arbitrary shell/MCP actions.
• Ordinary cancellation does not blindly drop already executing side-effecting tools; they finish or cooperate with cancellation.
• Full sub-agent transcripts remain unpersisted. Structured final outcomes and captured child-tool activity are retained instead.