feat: add native session rewind runtime and file controls

[Wolf-L]

Behavior and scope

Full companion to core rewind #610: named, negotiated runtime read/control APIs; safe idle steering; bounded native search; reversible archive/unarchive; attachment metadata; read-only queue discovery; and preview-token guarded reversal of one completed native file-change tool's recorded text patches in Git. No generic native RPC tunnel is exposed. File reversal preserves conversation history, index and unrelated edits, and fails closed for stale/unsafe/unsupported patches.

Replaces #597 after withdrawing the earlier submission. Refreshed on upstream main 202e66e63343ec4f5a5e35ab590251d813d129ca (2.2.2). It includes the core rewind implementation and all its follow-up fixes. Both PRs target main: review/merge core first, then refresh this full companion. The independent persistent queue proposal supplies write/start ownership and is deliberately not mixed into this branch. Rewind protocol/original implementation credit Nikita Ashikhmin's #508.

Current-main integration

• Preserve custom instructions, sessionIndex subscriptions/rename/deletion semantics, whole-turn usage and supervised app-server recovery. Exactly one archive/unarchive router dispatches indexed clients to upstream and other clients to the negotiated legacy response.
• Restore app-server/session readiness inside the proper operation fences; a persisted pending queue blocks lazy resume before native auto-dispatch can occur.
• Preserve originating-client process error mapping. Compiled process helpers dispatch before application imports and require private descriptors; no executable source is accepted.
• Runtime mutations have deadlines and owned-provider cleanup. File-revert recovery itself is included in the deadline; late readiness cannot continue after invalidation. Unknown outcomes are not replayed. Rewind also drains title writes retained from replaced/closed session states and permits close to break a provider-update/prompt wait.

Local validation

• Ubuntu 24.04 / Node 24.14.0: typecheck/build passed; full suite 1664 passed, 37 skipped (single worker, serial files).
• Windows targeted extension/process/title/recovery suites: 180 passed, 3 platform skips; broader current-main subscription baseline failures are not represented as a green Windows full suite.
• Pinned native Codex 0.160.1, isolated home/workspace and loopback Responses fixture: 18/18 on Windows and Linux. This includes actual text-patch restoration, history preservation, runtime/archive/attachments and rewind/cold-resend behavior.
• All six Bun release targets compile; six compiled POSIX cleanup/entrypoint cases pass with Node absent from child PATH. This does not prove physical ARM or every target's runtime behavior.
• No real account/model, global package installation or user session was used. These are local results, not hosted CI or maintainer acceptance.

Limits: No whole-workspace checkpoints, binary/shell/unrecorded-subagent reversal, full native queue automatic-turn ownership, realtime voice or complete Desktop UI parity. Native search may miss retained ancestor-rollout content. External writers remain outside adapter locks; Git checks narrow rather than eliminate OS-level races. Process-group cleanup cannot cover descendants that deliberately leave the group. A loopback provider/deny proxy is not an OS firewall.

中文

撤回旧 #597 后，基于主线 202e66e（2.2.2）重做完整增强 companion：包含同 ID 对话回退，并提供结构化运行读写、空闲 steering 协商、搜索、归档、附件元数据、只读队列查询和单工具文本补丁预览/反向应用。应先审核核心，再以合并后的基线刷新本分支；持久队列写入是独立提案。

保留上游 sessionIndex 通知/删除语义和 app-server 恢复，避免双重 archive 路由；在互斥范围内恢复原生连接，自动恢复前拒绝未接管的队列。补齐 provider/close 和跨状态标题竞态；超时或未知修改结果不自动重试。

验证：Linux 全量 1664 通过/37 跳过，类型检查/构建通过；Windows 定向通过；双平台隔离真实原生各 18/18；六发行目标交叉编译和六项 POSIX 编译产物测试通过。Windows 上游基线失败保留，未声称真实账号/模型、ARM 实机或托管 CI 全绿。

文件反向应用不是完整 checkpoint；外部写入、脱离进程组的子进程、完整原生队列接管与 Desktop UI 等均不在保证内。

Extension-only diff from the included core.