feat(coding-agent): ACP semantic-edges-v1 provenance producer - #1885

… ledger repair

Review round 2 on the lineage-v1 producer: retry Idempotency-Key reuse now
requires a byte-identical body (sha256 of model + system prompt + messages)
instead of a shape proxy; spawn ancestry is snapshotted synchronously at the
spawn entry point and survives resume via ledger replay; child terminal
status is recorded once at actual release (reusable children stay running
across follow-up runs, startup failures record failed); ledger construction
never mutates the file (torn-tail repair deferred to first append) and only
a malformed unterminated final line counts as torn; the completed-compaction
ledger event now precedes the transcript commit. Adds host pass-through,
real-summary-call wire, negative validator calibration, replayed-status,
double-wrap, and failed/cancelled mapping coverage.

Round 3 on the lineage-v1 producer. The retry body hash is now computed
eagerly at request creation, before the wire call, so mutating the live
message objects between the failed call and the retry park can no longer
alias two different bodies under one Idempotency-Key (TOCTOU regression
test included; the lazy-thunk indirection is gone). Test hardening from
the mutation campaign: hash keyed on provider/model/systemPrompt each
proven independently; undefined-vs-undefined parked hashes never match;
readLineageLedger proven read-only; torn-tail repair proven single-shot;
spawn-ancestry snapshot proven to precede preflight awaits; the completed
compaction ledger event proven durable before (and exactly once despite
a failing) transcript commit. The invariant port checks compactions
before requests and the negative calibration table asserts the named
error per row, adding duplicate-context, session-owner, and per-predicate
isolation rows.

readLineageLedger is proven to never open the ledger for writing (a
missing path must throw ENOENT and stay missing; a zero-byte append-open
would create it), and the calibration table gains a row where a fully
valid child compaction is named by a root request, so only the
request-side compaction owner check can reject it.

…edges-v1

The ecosystem replaced lineage-v1 (nano-rlm #153, verifiers #2449): one
renamed correlation header (X-ACP-Model-Request-ID + Idempotency-Key) and
sparse commit-gated semantic edges instead of a full session manifest.
The durable per-session JSONL ledger keeps its hardened mechanics
(ledger-before-wire, torn-vs-corrupt tails, repair-on-first-append,
read-path purity, replay idempotence, eager body-hash retry identity,
synchronous spawn snapshots) and now records request outcomes: the
streamFn wrapper commits or fails each request when its stream resolves,
compaction summaries commit around the real wire call only, and a parent
claims a child_returned with the child's last committed request at the
success point. deriveSemanticEdges is a pure order-independent fold to
continuation/subagent_call/subagent_return/compaction edges: edges
materialize only when their target commits, failed requests return their
inbound edges to the session's pending set (prime-agent has no prompt
rollback, so they attach to the next commit), spawn edges defer to the
child's first committed request, and a completed compaction suppresses
the summary's own continuation. Deleted: context epochs, session status
recording, depth in ledger events, the manifest deriver, and the
lineage-v1 validator port with its calibration table.

Two isolated compaction fold gates (a committed summary followed by a
later commit, and a failed compaction after a committed summary, each
producing no compaction edge), distinct wrapper outcome cases including a
rejected stream promise and an aborted final message (both must fail the
request), and the wire header asserted as the literal string
X-ACP-Model-Request-ID so a renamed production constant cannot pass.

Aligns with nano-rlm a1d7856: a failed child still returns an error
outcome the parent consumes, so the failure settle point now records
child_returned with the child's last committed request. Cancelled runs
and zero-commit children stay silent; the returned-once guard is
unchanged. Tests cover the failed-with-commits return edge, failed
zero-commit silence, and cancelled-with-commits silence.

…uations

The terminal flush appended pending edges after the last summary slice
had already emitted its regenerated continuation, so a reclaimed
continuation from the same source derived twice — duplicate edges the
consumer rejects. The flush now applies nano's source-only suppression:
a pending edge from X removes the slice's generated continuation from X
regardless of the pending edge's type, then pending flushes once.

# Conflicts:
#	packages/coding-agent/src/core/agent-session.ts