refactor(runtime): improve testability and simplify package structure

[dgageot]

Improve the testability of pkg/runtime through targeted dependency injection, extraction of inline subdomains into focused types, and a final pass of cleanup/reorg. No public API changes; no observable behaviour changes.

Coverage of pkg/runtime rises from 53.6% → 56.5%; the package gains 17 new files (mostly tests) and runtime.go shrinks from 1081 to 963 lines.

Why

Several patterns in the runtime forced tests to either skip whole code paths or do invasive things to reach them:

• time.Now() was hardcoded in 8 places (timestamps, fallback cooldowns, tool-call latency); tests had to scrub timestamps with reflection or sleep on real wall-clock.
• NewLocalRuntime did disk I/O via modelsdev.NewStore and could fail at construction on hosts where os.UserHomeDir is unhappy.
• Telemetry was emitted via package-level helpers, so tests had no way to assert what was recorded.
• Magic numbers (128 event-channel buffer, maxOverflowCompactions = 1, 5*time.Second) lived inline; tests couldn't drive both branches of the overflow-recovery path without 1+ real overflows.
• The RunStream goroutine was a 250-line anonymous closure mixing iteration limits, fallbacks, hooks, compaction, tool dispatch, steer/follow-up draining — none of it independently testable.
• A handful of subdomains (fallback cooldowns, current-agent routing, the elicitation channel + mutex) were raw fields on LocalRuntime with concurrency contracts that could only be reasoned about by reading the surrounding methods.

model_switcher_test.go was the smoking gun: 5 tests bypassed NewLocalRuntime entirely with &LocalRuntime{...} struct literals because the constructor was too coupled.

What

12 focused commits, each independently reviewable:

#	Commit	Effect
1	test(runtime): cover resume helpers, ElicitationError, and tool loop detector reset	+tests for previously 0%-covered helpers
2	refactor(runtime): inject clock via WithClock for deterministic tests	All time.Now() → r.now(); new WithClock Opt; cooldown-eviction now testable without sleeping
3	refactor(runtime): defer modelsdev.NewStore until first use	New lazyModelStore; constructor no longer hits disk
4	refactor(runtime): introduce Telemetry interface for testable observability	New Telemetry interface + WithTelemetry Opt; default forwards to pkg/telemetry
5	refactor(runtime): name magic numbers and let tests override the overflow cap	defaults.go constants + WithMaxOverflowCompactions Opt
6	refactor(runtime): extract elicitationBridge to encapsulate the swap+send race contract	Concurrency contract in 50 LOC, race-detector test
7	refactor(runtime): extract enforceMaxIterations and handleStreamError from RunStream	-81 lines from RunStream goroutine, +9 unit tests for previously-unreachable branches
8	refactor(runtime): extract cooldownManager from fallback.go	Eviction-on-read contract testable in isolation
9	refactor(runtime): extract agentRouter	5 methods → 1 type with race-detector test
10	refactor(runtime): drop pass-through wrappers and constructor double-build	-42 net lines: deletes 4 one-line wrappers, builds cooldown manager once instead of twice, deduplicates the max-iterations stop message
11	refactor(runtime): hoist RunStream goroutine body into runStreamLoop method	Anonymous go func(){...} → named method, real symbol in stack traces
12	refactor(runtime): regroup elicitation and resume code into focused files	New resume.go + elicitation.go; runtime.go drops to 963 lines

New testability seams

Opt / type	Use
WithClock(func() time.Time)	Deterministic timestamps + cooldown windows
WithTelemetry(Telemetry)	Recordable observability events
WithMaxOverflowCompactions(n)	Drive both retry and exhausted branches
lazyModelStore	Deferred catalog loading
elicitationBridge, cooldownManager, agentRouter	Race-tested concurrency primitives
enforceMaxIterations, handleStreamError	RunStream branches reachable without end-to-end mocks

All concurrency primitives have race-detector tests that drive the contract directly (e.g. TestElicitationBridge_SwapWaitsForInflightSenders exercises the swap-vs-inflight-send interleave that the previous raw mutex+field carried implicitly).

Validation

• go build ./... ✅
• go test ./pkg/runtime/... -race -count=1 ✅
• mise lint ✅ (golangci-lint, custom lint, go mod tidy)
• mise test ✅ (full module, exit 0)
• Coverage of pkg/runtime: 53.6% → 56.5%

Notes for reviewers

• No public API changes. go build ./... confirms no callers outside pkg/runtime were affected.
• One pre-existing bug in pkg/telemetry/context.go (argument order swap in the wrapper, cancelled by an inverse swap at the runtime callsite) was discovered during commit 4 and explicitly preserved to keep this PR's scope tight. Worth a separate PR.
• event.go's time.Now() for AgentContext.Timestamp is intentionally untouched — wire-format only, scrubbed by the existing clearTimestamps test helper.
• The 6 simplification opportunities found after the testability work (commits 10–12) are stacked on top, so the testability changes can be cherry-picked alone if preferred.

Assisted-By: docker-agent