feat(storage): implement production session snapshots

[MicroGery]

Summary

Implements PR 2 of #2369: the production path that turns a live, quiescent Session into a private Bundle staging snapshot.

• bind one Maka Session, its workspace, and its Cloud Bundle envelope at service construction so call-time identity fields cannot mix Sessions
• wire the coordinator to Runtime Kernel admission plus a required Host eligibility authority
• export filtered Session SQLite state, reserve its Bundle budget, then copy only the remaining permitted workspace budget
• enforce root separation, reject unsafe links, use no-follow descriptor-based workspace copying, and check cancellation between copy chunks
• wire authenticated confirmation decisions for suspected-secret paths and retain cleanup through pack
• add production round-trip, identity-tampering, root-overlap, confirmation, quota, and Runtime mutation-lane regression coverage

Refs #2369

Security / review focus

The production factory is deliberately single-Session. It rejects overlapping state/config/workspace/staging/cleanup roots and does not expose the raw coordinator, preventing a caller from pairing one Session state with another Session workspace.

The Runtime adapter now requires a Host eligibility check for mutable states outside the Runtime Kernel execution claims. The Host remains responsible for making that authority cover its pending approvals, background work, and external-resume paths.

Verification

• npx biome check on changed storage/runtime sources and tests
• npm run typecheck --workspace @maka/storage
• npm run typecheck --workspace @maka/runtime
• npm test --workspace @maka/storage — 1,037 passed, 0 failed, 8 skipped
• node --test packages/runtime/dist/tests/quiescent-session-snapshot.test.js — 5 passed, 0 failed
• npm test --workspace @maka/runtime — snapshot coverage passes; two pre-existing AI SDK streamed-reasoning tests still fail:
  • Alibaba Responses replay keeps multiple reasoning items distinct
  • pinned SDK maps official summary events across raw byte chunks

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: OpenAI Codex assisted with implementation, adversarial review, regression tests, and local verification. The contributor reviewed the changes and remains responsible for their accuracy, provenance, and licensing.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — production Session Bundle snapshot preparation is now available through the new storage/runtime composition APIs.
• No

[Astro-Han]

Thanks for this — the composition is tight and the identity binding is the right call.

Verified against head db23cff898:

• Budget reservation matches the codec. reserveStateBundleBudget reserves the recursive state entry count plus 3 (state-identity.json, state/, workspace/), which is exactly what packSessionBundle ends up counting, so the workspace copy is bounded by the real remaining quota rather than discovering the overflow after copying.
• The copy window is closed. O_NOFOLLOW degrades to 0 on Windows, but copyWorkspaceFile compares the pre-open lstat fingerprint (dev/ino/size/mtimeNs/ctimeNs) against the post-open fstat, so a symlink swap changes the inode and fails as source_changed. Directories are fingerprinted on entry and exit.
• Exposing recover() is safe. session-copy-cleanup.ts:197 skips records whose ownerLifetimeRef is this process, so a host calling recover() during an in-flight prepare() cannot delete its own staging.
• Root separation is consistent with the existing assertActivationRootLayout contract, not a new constraint on deployments.

Four non-blocking observations, all fine as follow-ups:

1. production-session-snapshot.ts:337-347 — when bundleFileService.pack succeeds but prepared.release() rejects, the successful artifact is discarded and the error thrown. The Bundle is still on disk at destination, so retrying the same path fails permanently in assertDestinationMissing. Since PreparedSessionBundleHandle documents release failures as retryable and the staging lease self-heals on the next recover(), returning the artifact and surfacing the cleanup failure separately would lose nothing.
2. packages/runtime/src/quiescent-session-snapshot.ts:92-112 — the catch rewrites every non-SessionSnapshotError from operation() as io_failure / phase: 'admission'. The signal.throwIfAborted() calls in resolveWorkspaceConfirmation raise a bare AbortError that normalizePreparationError would otherwise map to snapshot_cancelled. Mapping only SessionQuiescentMutationBusyError and rethrowing the rest would keep the coordinator's normalization intact.
3. production-session-snapshot.ts:612-628 — names that are legal on POSIX but unrepresentable in USTAR V1 (aux, trailing ./space, \ : * ? " < > |) fail the whole snapshot under the same unsafe_path category as symlinks, with no path or count in details. Fail-closed looks right given the current exclusion enum, but a distinct category or an observed counter would make it locatable.
4. production-session-snapshot.ts:125,260,274,281-289,312 — the coordinator runs prepareState → prepareWorkspace inside one serialized quiescence lane, so the staging-root-keyed Map, the dirname() keying, the finally { clear() }, and the public remainingLimitsForDestinationRoot option could collapse into a single closure variable.

Review assistance: Claude (Claude Code) traced the production path and cross-checked the quota accounting, copy-window checks, and cleanup ownership against current main; I reviewed and confirmed those findings myself and own this approval.