Unify command execution under shell

[fazxes]

Summary

• Replace the procedural terminal schema with shell.run, shell.wait, shell.write, shell.stop, and shell.list.
• Complete short commands inline and retain long, zero-yield, and TTY commands under one managed session ID.
• Wait up to 30 seconds for initial completion and use bounded five-second follow-up observations by default.
• Generate fx-owned execution handles so reused provider call IDs cannot collide with later commands.
• Use compact shell-prefixed durable TTY IDs while retaining existing authority and persistence checks.
• Treat an explicitly requested stop as a successful control action instead of presenting the process signal as a command failure.
• Let a running shell.run explicitly hand control back to the user for cross-turn work, without forcing a same-turn wait or stop.
• Preserve the original user instruction during that handoff response and restore normal tool choice on the next user turn.
• Accept terminal-host handshakes before durable catalog recovery finishes, and preserve shared state if startup fails with clients still attached.
• Give the dedicated terminal host a bounded 1024-descriptor soft budget, capped by the kernel hard limit, so macOS GUI launches can recover the 64-session catalog.
• Enforce TTY deadlines from command start and report known timeouts without indeterminate status.
• Reindex durable model-managed and direct-human TTY sessions when an fx session resumes, while retaining durable authority checks.
• Preserve incremental and final output with bounded inline results and full replay handles.
• Keep overlapping command output isolated and show running work through Ctrl-X and across /clear.
• Stop the agent loop after the same Shell action fails in consecutive batches.
• Support up to 64 live managed executions with process-tree cleanup on exit, stop, and timeout.
• Migrate legacy background ownership to inert history after token-validated cleanup.
• Remove the monitor, detached-background, and direct terminal lifecycle implementations.
• Keep Shell behavior consistent across the TUI, CLI, ACP, no-save, and browser surfaces.

Verification

• Full Zig test suite, formatting checks, and ReleaseSafe build.
• Deterministic Shell, terminal-host, permission, ACP, rendering, cancellation, resume, and stress E2Es.
• ReleaseSafe cross-builds for Linux and macOS on x86_64 and arm64 through CI.
• Real Ghostty run under its inherited 256-descriptor limit, covering short, retained background, wait, interactive TTY, timeout, list, and cleanup flows.
• Three fresh Luna TUI runs of the canonical two-turn retained-process scenario, all passing both phases with exact output markers and cleanup.
• Bare direct Codex control using the same Luna model, xhigh effort, fast tier, and canonical scenario.

[vercel-security-reviewer]

Security review: https://vercel.slack.com/archives/C0BSEH6GB18/p1787978345590399