fix(notebook): preserve control RPC capability across ACP cleanup

[ewen-poch]

Problem

ACP session cleanup revoked every session-bound Notebook RPC capability, including the private control-plane capability captured by a persistent REPL. The live REPL then reused a stale token, so later host.mcp() calls failed locally with Invalid notebook RPC token. before reaching the connector.

Proposed change

• Reuse the existing Agent-facing capability revocation seam during ACP cleanup.
• Keep persistent control capabilities owned by the Notebook session and released through connection.release() during Notebook teardown.
• Add a real persistent-REPL regression proving host.mcp() succeeds before and after ACP cleanup.

Scope and non-goals

This changes only the internal capability lifecycle. It does not change the data model, data relationships, UI behavior, token injection protocol, or add retry/token-refresh machinery.

Acceptance criteria and validation

All commands ran after the final material edit:

• Persistent control capability survives ACP cleanup -> RUN_KERNEL=1 npm test -- src/main/notebook/local-rpc-server.test.ts src/main/notebook/host-mcp.integration.test.ts -> 43/43 passed.
• Node contracts remain valid -> npm run typecheck:node -> passed.
• Full type contracts remain valid -> npm run typecheck -> passed.
• Lint remains clean -> npm run lint -> 0 errors, 19 baseline warnings.
• Repository regression suite remains green -> npm test -> 9,754 passed, 184 skipped.

Independent review found no actionable issues. Low residual risk: Notebook teardown revocation is covered compositionally across runtime, registry, and RPC-server suites rather than by one end-to-end shutdown test wired to a real local RPC server.

Review focus

Please verify that ACP cleanup still revokes Agent-facing capabilities and routing metadata while control-plane capability ownership remains exclusively with the Notebook session lifecycle.

[github-actions]

Codex Review

Verdict: mergeable

No actionable findings.

Summary: No concrete merge-blocking defects found in the pull request changes. Branch and title prechecks are valid.