feat(server): archive the transcript tail when a session ends without Stop (RIG-4135)

[rigel-mintaka]

This PR is part of a stack containing 4 PRs:

1. main
2. fix(runnerhub): scope Runner-originated binding calls to the session's tenant (RIG-4146) #1463
3. "feat(server): archive the transcript tail when a session ends without Stop (RIG-4135)" (this PR)
4. fix(delivery): wake owed agents when a Runner attaches (RIG-4166) #1465
5. fix(server): run a delivery-loop wake under the agent's tenant (RIG-4167) #1466

Fixes RIG-4135 (Matt's ruling: B, archive on a detected end). Stacked on #1463.

Change

• New runnerhub.SessionEndSink. The hub calls it when a session ends without Stop:
  • in dropLostSession, when the owning Runner answers a deliver with NOT_FOUND (the container is lost), under the session's tenant from fix(runnerhub): scope Runner-originated binding calls to the session's tenant (RIG-4146) #1463;
  • for each binding the re-enroll reap removes.
• archiveEnded runs the sink detached from the Runner stream, with a 2-minute bound.
• server.archiveSessionEnd is Stop's existing best-effort session_end flush, moved out of StopAgentSession. The Stop path and the new sessionEndArchiver sink now share it.
• session_end never prunes, so a later resume still reads the PG tail. A resume followed by Stop archives the larger range again. Overlapping session_end segments have no reader that cares: resume reads only safety_valve.

Tests

• TestSessionEndedWithoutStopIsArchived (runnerhub): the lost drop and the re-enroll reap each archive exactly the ended session, and a foreign Runner's refusal archives nothing. Removing either hook makes it fail ("no session-end archive within 10s").
• TestReenrollReapArchivesSessionEnd (server pgtest): a reaped session gets one session_end segment over [1..2], and both PG rows stay. Unwiring the sink makes it fail ("session_end segments = 0 after the re-enroll reap").
• e2e crash_leaves_no_session_end became crash_archives_session_end: against real Garage, podman rm -f the container and @mention the agent; a session_end segment carrying the first reply appears, and nothing is pruned as superseded. The full TestLegS3DurabilityValves passes (5/5).
• The runnerhub, server, store and delivery suites pass (unit and pgtest, -race). Lint reports 0 issues in the touched files.

Known gap

• The re-enroll reap still runs without a tenant (fix(runnerhub): scope Runner-originated binding calls to the session's tenant (RIG-4146) #1463 follow-up), so for a non-bootstrap tenant its archive finds no rows and does nothing. The single-tenant setup is unaffected.

[linear-code]

RIG-4135

[github-actions]

Compass engineering docs preview: https://compass-server-rig-4135-arch.compass-eng-docs.pages.dev

Deployed from compass-server/rig-4135-archive-detected-end at 342dba1.

[trunk-io]

This pull request was merged into main as part of stacked PR 1466.