feat(runtime-host): carry exact Connection identity in Session model targets

[me2seeks]

Summary

Depends on #3864. Until that PR lands, Files changed temporarily includes its immutable Session identity foundation. Review the #3926 increment as range 16841bd..3b7807a.

This PR closes the exact account-selection wire and recovery path:

• explicit Session model targets carry connectionId + connectionSlug + model;
• Session catalog projections expose a required nullable connectionId;
• Runtime Host owns patch merge, exact target validation, and the atomic Session configuration commit;
• CLI/TUI and Desktop preserve the same immutable target across revision-conflict retries;
• legacy or deleted-account Sessions recover only after an explicit account selection;
• non-model updates preserve the original account, including after same-slug reuse;
• TUI and Desktop distinguish legacy, disabled, deleted, and identity-mismatched account state.

Fixes #3926

Breaking wire change

RUNTIME_HOST_COMPATIBILITY_EPOCH advances from 51 to 52. The projection field, explicit target shape, and configuration patch operation are intentionally closed and incompatible with epoch-51 peers.

Configuration updates no longer accept a default target. An omitted model target means preserve the persisted tuple; only an explicit exact target can change or recover the account and clear NO_REAL_CONNECTION. Session creation still supports the Host-owned canonical default.

Review focus

• Host authority: packages/runtime-host/src/server/session-catalog-coordinator.ts
• Protocol and epoch: packages/runtime-host/src/protocol/session-catalog.ts and packages/runtime-host/src/protocol/index.ts
• Real delete/reuse/recovery path: packages/runtime-host/src/tests/session-catalog-two-client-uds.test.ts
• Exact CAS replay: Desktop runtime-host-client and CLI runtime-host-session-driver tests
• Surface identity and recovery: CLI TUI runner and Desktop model-selection files

Verification

• Runtime Host full suite: 1262 passed, 0 failed, 9 skipped
• Runtime Host protocol/coordinator/real UDS: 109 passed
• CLI/TUI focused: 232 passed
• Desktop affected suites: 118 passed
• Core exact projection/model tests: 19 passed
• Runtime SessionManager: 208 passed
• Core, Runtime, Runtime Host, Eval, Desktop main and Desktop renderer builds/typechecks: pass
• Biome on all 77 changed files and git diff --check: pass
• Two independent final code reviews on 3b7807a: GO, no P0-P2 findings

Known baseline/environment blockers:

• CLI full build cannot resolve @agentclientprotocol/sdk in this isolated worktree; changed CLI output was emitted and the affected 232 tests pass.
• UI build reports the same settledText, conversationKey, unlockAutoFollow, and trailingAction errors on the feat(runtime): bind new sessions to connection identity #3864 base worktree; no new changed-surface error is introduced by this PR.

Stacked PR lifecycle

• feat(runtime): bind new sessions to connection identity #3864 merged
• Rebase this branch onto current main
• Re-run freshness validation and final dual review
• Mark ready for review

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Codex implemented the Runtime Host wire, surface adoption, tests, validation, and review integration. The commit includes a Generated-by trailer.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

The affected suites, formatting, and scoped typechecks pass. The unchecked item records the two baseline/environment blockers described above.

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

[me2seeks]

Superseded by #3864 at bad6984f8. The exact Session Connection identity wire, Runtime Host authority, and Desktop/CLI/TUI recovery were recombined there to avoid an unsafe intermediate state for legacy Sessions.