feat(storage): add SessionRepository contract

[MicroGery]

Summary

Implements phase 1 of #2370: the V1 Session checkpoint Manifest, immutable-object and SessionRepository contracts, a deterministic in-memory conformance implementation, and CAS and idempotency race tests.

This PR defines the control-plane semantics and testable adapter boundary. It does not provide a production durable backend.

Contract

The design keeps three operations distinct:

• ImmutableObjectStore.publish and assertReadable publish and verify immutable Bundle and Manifest bytes.
• ImmutableObjectStore.materialize copies one verified immutable object to a caller-owned new path, never overwrites it, and enforces a caller-provided byte limit.
• SessionRepository owns Session identity bindings, opaque Repository revisions, head CAS, current and exact checkout, and commit and Fork idempotency semantics.

A visible Session head resolves through the V1 checkpoint envelope:

Session head
  -> immutable SessionCheckpointManifestV1
       -> compatibilityBundle: immutable verified #2369 Bundle

Publication follows the required order: publish and verify the compatibility Bundle; canonically encode, publish, and verify the Manifest; then create the Session or CAS-publish its head.

A first Fork claim verifies the explicit source revision, then persists its exact admitted checkpoint and agent binding. If the source later advances, retry still returns that durable claim. materializeSessionCheckpointV1 converts the retained V1 Bundle reference into the bounded SessionBundleSource required by the existing file inspect and hydrate boundary. The future Fork owner can therefore hydrate, re-key, or repack the admitted source after a worker restart without re-reading the old head. This PR deliberately does not implement that future orchestration.

The contract rejects same-Session Fork targets, requires target and source agent binding to agree, and rejects inherited Activation identity on a Fork-created target.

Non-goals and follow-up

• Implement the durable Repository and Immutable Object Store adapters in the stacked feat(storage): add durable file SessionRepository #4674.
• Wire this Repository into Cloud Session Activation and Fork orchestration.
• Implement target state re-keying, repacking, and full Bundle hydration in the owning Fork work.
• Add remote storage and multi-process integration coverage.

Refs #2370

Verification

• Core and Storage builds and Storage typecheck
• node --test packages/storage/dist/__tests__/session-repository.test.js — 18 passed
• Biome check for the contract and tests
• GitHub Actions CI is running for the current head

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Codex updated the SessionRepository contract, in-memory conformance implementation, tests, and PR description under human contributor ownership.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and affected suites pass locally

Does this PR entail a change in behavior?

• Yes — it adds the internal Cloud Session checkpoint Manifest, immutable object publication and materialization, revision CAS, and Fork idempotency contract described above.

[hqhq1025]

Reviewed exact head 914b2fc1d00e98861ff84fe6f3911591a0527faa. This adds the V1 checkpoint Manifest/object-store contract plus the in-memory SessionRepository conformance implementation and tests. I found two correctness gaps in Fork recovery and target provenance; details are inline.

Validation: clean install; Core and Storage builds; Storage typecheck; focused SessionRepository tests (18/18); full Storage tests (1,114 passed, 10 skipped); Biome, ASF headers, and diff checks; hosted test green. A clean synthetic merge against current main 01fe14bd271c38d65e82ce58d1448b10a5844a46 passed the same focused and full Storage checks. The first local full-suite run exposed an unrelated Node 22.22.1 warning-sensitive child-process test; suppressing the runtime warning made that isolated test and both full suites pass.

Not assessed: the durable backend and multi-process semantics, which this PR explicitly leaves to follow-up.

Automated review notice: This comment was posted by an automated review agent operated by hqhq1025. It is not an independent human review and does not replace one.

[likun666661]

Reviewed exact head 9b0b438746f99ec028a230be22f424ce411a3f87. The two earlier Fork findings are fixed, and the focused contract suite passes. One remaining contract-level recovery gap is inline.