feat(session): record every guard intervention

[filipeforattini]

Why

0.14.0 ships five guards over the turn — the inactivity watchdog, a deadline on every tool, the
loop guard, the graduated step budget, and bounds on the calls around a turn. Every threshold in
them (300 s of silence, 600 s for a tool, three identical calls, two steps of grace) was chosen by
argument, because there was nothing to measure. And each intervention left only a
logWarning in the server log, so the obvious questions had no answer: does the watchdog ever
fire? does it fire when it should not? did the loop guard ever catch a real loop, or does every
timestamped tool output escape it?

What this adds

• A record. Each trip is written to session_guard_trip: which guard, what it acted on, what
  it did (warn / correct / stop), and the detail the policy module already produces.
• A live event. session.next.guard.tripped, so the TUI, plugins and the SDK can react now.
  Deliberately not durable: this is evidence about the run, not part of the conversation, and
  the durable manifest is the session's source of truth rather than a diagnostics channel.
• A way to read it. redcode debug guards [--days 7] [--limit 20] prints counts per guard and
  action, loudest first — what fires most is what most needs its threshold questioned — then the
  most recent trips. When nothing fired it says so in words, because an empty table reads as "no
  data collected", which is a different answer.

Recording can never break a turn: a failed write is logged and the intervention still happens.

Verification

• Integration test: a hung tool trips the deadline, and the trip comes back from recent() with
  the right guard, action, subject and session, and aggregates through summary().
• Unit tests for the aggregation, including the ordering rule and the empty case.
• The migration is generated through packages/core/script/migration.ts rather than hand-written —
  my hand-written one passed my own test and failed the repo's schema-drift check, which is exactly
  what that check is for.
• packages/core 1143 pass; packages/redcode session suite 450 pass, with the one failure this
  machine reproduces on unmodified sources (the feat(session): end a turn that has stopped producing anything #103 watchdog test, 60 s timeout under local load).

One thing worth knowing

An unrelated edit to packages/llm/src/schema/messages.ts was sitting uncommitted in my working
tree from before this branch and got swept into the first commit; it breaks tool-runtime.ts
typechecking. It is not part of this change and has been reverted here — flagging it in case it was
someone's work in progress.

https://claude.ai/code/session_01GnxRKZmMXe7qcqVXFKwdkJ

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}