feat: add session thread management (#98510)

* feat: add session thread management

Squash of codex/thread-management (025aefc3ad1) onto origin/main:
pin/archive/rename sessions via sessions.patch, archived-aware
sessions.list, lifecycle fencing, read-only archived chat, SDK +
Swift protocol support, Control UI session management.

* refactor(ui): minimal session rows with hover-revealed management

Chat picker and sidebar recents share session-row primitives: single-line
rows, relative timestamps, rename/archive/pin revealed on hover or focus,
accent pin badge for pinned rows, and an active-run spinner in the trail
slot. Sidebar floats pinned sessions above recency via the shared
comparator and gains archive/pin actions through the unified sessions-view
patch fallback. Archive eligibility is one shared policy
(canArchiveSessionRow); the sidebar/picker active-run tooltip now uses the
real sessionsView.activeRun locale key.

* fix: align session admission with mailbox-era main

Integration fixes after rebasing onto current main: sessions_list mailbox
test expectations learn the archived/pinned row fields and archived:false
list param; gateway agent admission treats a session as deleted only when
both the requested and canonical alias sets miss it (legacy bare-main
stores and exec-approval followups read under different spellings); cron
persist tests keep a consistent store across claim-guarded persist calls;
the ACP abort hook test asserts abort propagation instead of signal
identity; drop dead lifecycle writes flagged by no-useless-assignment and
fix the promise-executor return in the codex compact test.

* fix(qa): align UI e2e and shard fixtures with redesigned session rows

Sidebar session rows are wrapper divs with an inner link now: update the
navigation browser tests and chat-flow Playwright selectors. Seed a real
per-test session store for the auto-fallback admission guard instead of
depending on leftover host files at /tmp/sessions.json. Teach the
test-projects routing fixture about the suites that newly import the
shared temp-dir helper. Document the Codex thread-format contract for
archivedAt/pinnedAt (flag derived from server-stamped timestamp, epoch ms
here vs Codex epoch seconds) at the type and in the session docs.

* test: route auto-fallback suite through temp-dir helper plans

The auto-fallback suite now imports the shared temp-dir helper for its
seeded session store, so the top-level helper routing fixture must list
it in the auto-reply plan.

docs/plugins/codex-harness-runtime.md

@@ -225,9 +225,17 @@ history, search, `/new`, `/reset`, and future model or harness switching.
 
 Explicit compaction requests, such as `/compact` or a plugin-requested manual
 compact operation, start native Codex compaction with `thread/compact/start`.
-OpenClaw returns after starting that native operation. It does not wait for
-completion, impose a separate OpenClaw timeout, restart the shared Codex
-app-server, or record the operation as an OpenClaw-completed compaction.
+OpenClaw keeps the request and shared-client lease open until Codex emits the
+matching `contextCompaction` completion item and then reports the compaction turn
+as completed. If that terminal turn exceeds the configured compaction timeout,
+OpenClaw requests a native turn interrupt. The lease and per-thread compaction
+fence remain held until Codex reports terminal state or confirms the interrupt RPC.
+If Codex does not confirm within the interrupt grace period, OpenClaw retires
+the connection before releasing the fence. Remote connections also detach the
+matching thread binding so later work cannot overlap an unconfirmed remote
+turn. Other turns on a retired connection fail and can retry on a fresh client.
+Client closure, request cancellation, or a failed compaction turn returns a
+failed operation.
 
 When a context engine requests Codex thread-bootstrap projection, OpenClaw
 projects tool-call names and ids, input shapes, and redacted tool-result content
@@ -235,10 +243,10 @@ into the fresh Codex thread. It does not copy raw tool-call argument values into
 that projection.
 
 The mirror includes the user prompt, final assistant text, and lightweight Codex
-reasoning or plan records when the app-server emits them. Today, OpenClaw only
-records explicit native compaction start signals when it requests compaction. It
-does not expose a human-readable compaction summary or an auditable list of
-which entries Codex kept after compaction.
+reasoning or plan records when the app-server emits them. OpenClaw records the
+native compaction start and terminal status, but it does not expose a
+human-readable compaction summary or an auditable list of which entries Codex
+kept after compaction.
 
 Because Codex owns the canonical native thread, `tool_result_persist` does not
 currently rewrite Codex-native tool result records. It only applies when