feat(core): interrupt v2 session execution

[kitlangton]

Stage 1: Interrupt The V2 Runtime

Embedded V2 Sessions execute through a process-global coordinator and a Location-scoped runner:

SessionV2 -> SessionExecution -> SessionRunCoordinator -> SessionRunner

This PR exposes interruption through the public native API:

const opencode = yield* OpenCode.Service
yield* opencode.sessions.interrupt(sessionID)

The call interrupts the active process-local drain and waits for runner cleanup, including partial output flushes and interrupted local tool settlement.

Idle or missing Sessions remain idempotent no-ops at the runtime boundary.

Invariant: one Session has at most one executing generation; interruption settles only after the active owner finishes cleanup.

Stage 2: Record A Durable Interruption Boundary

For a recorded Session, SessionV2.interrupt first publishes the synchronized durable event:

session.next.interrupt.requested

Its aggregate sequence is the ordering boundary between old and new user intent.

sequenceDiagram
  participant App
  participant Events as Session events
  participant Coordinator
  participant Runner
  App->>Events: InterruptRequested
  Events-->>App: interrupt sequence
  App->>Coordinator: interrupt(sessionID, sequence)
  Coordinator->>Runner: interrupt older active work
  Runner-->>Coordinator: cleanup settled
  Coordinator-->>App: settled

Loading

Publishing the event and delivering the local interruption request are uninterruptible together. Caller cancellation cannot commit the durable request without delivering it to the runtime.

InterruptRequested records intent and ordering. It does not claim that an activity was durably settled as interrupted, and it does not project a transcript message.

Invariant: requested interruption is a durable fact; confirmed interruption outcome remains process-local until durable activity lifecycle is designed.

Stage 3: Preserve New Intent Without Restarting Old Work

Prompt admission remains durable and immediate. The coordinator models each execution reason as a coalescible Demand: an explicit run or a wake carrying its admission sequence. Each Session lane keeps one current demand and at most one pending demand, so mode and ordering data cannot drift apart.

seq 10  Prompt B admitted
seq 11  InterruptRequested
seq 12  Prompt C admitted

• wakes at or before sequence 11 are stale and cannot restart interrupted work
• wakes after sequence 11 are preserved behind cleanup
• work after sequence 11 is protected if it starts before the local interrupt delivery arrives
• queued post-boundary work is also protected
• repeated interruption requests move the boundary forward
• delayed older interruption deliveries cannot erase or stop newer work
• queued and steered inputs remain durable; interruption does not delete submitted user intent

This handles delayed asynchronous wake delivery using durable event order rather than wall-clock timing.

Invariant: an interruption may stop only work at or before its durable boundary, never work admitted after it.

Stage 4: Keep V1 Compatibility And Lifecycle Claims Narrow

• The legacy V1 HTTP/SDK abort path remains unchanged.
• V1 continues to use SessionPrompt.cancel / SessionRunState.cancel and live session.status events.
• The new InterruptRequested event belongs to the V2 Session event model.
• No durable Interrupted outcome or activity identity is introduced.
• SessionExecution remains process-global and Session-ID based.
• Session runners, model resolution, tools, permissions, and filesystem access remain Location-scoped.
• Different Sessions continue to run and interrupt independently.

Invariant: this PR adds a durable request boundary and process-local execution interruption, not durable activity settlement.

Verification

• focused coordinator, Session prompt, runner, projector, and recorded-runner suites: 152 tests pass
• core package typecheck: pass
• repository-wide typecheck: 22 packages pass
• three rounds of independent race, code-quality, and test-coverage review; all concrete findings addressed with regression tests
• git diff --check

The full Core suite remains blocked by an unrelated regression already present on untouched dev: the session_context_epoch migration attempts to create its table twice. The focused interruption suites pass on this branch.