feat(sdk): add standalone Agent SDK Host baseline - #1720

Summary

• add a standalone local bitfun-sdk-host composition root using newline-delimited JSON-RPC over stdio
• keep Headless CLI, ACP, GUI/TUI, and SDK Host as sibling adapters over the same Agent Runtime owners
• route SDK Query submission, cancellation, settlement, permissions, Tools, MCP, events, and transient Session cleanup through existing runtime ports
• define strict initialize, Session, Query, cancellation, close, shutdown, capability, notification, and typed error contracts
• bound data/control requests, active Queries, leased Sessions, output delivery, request drain, and total shutdown work
• update the Agent SDK architecture document and module ownership guides to match the delivered boundary

Product boundary

This PR delivers an internal, standalone SDK Host implementation candidate. Its handshake reports not_delivered: it is not a public or stable SDK release, and this PR does not publish Python or TypeScript packages or claim full Claude Agent SDK parity.

The Headless CLI does not depend on or start the SDK Host. The SDK Host does not depend on the CLI. They select separate delivery profiles and share only the stable Runtime/port layer and product assembly plan.

Architecture and safety

• no second Agent loop, scheduler, Tool registry, MCP client, Permission engine, Session store, or CLI service graph
• Query submit/cancel use the same scheduler owner, and terminal results are emitted only after exact Turn settlement
• non-interactive SDK requests publish shared ToolContext facts and fail closed when user input is unavailable
• transient Sessions cannot expose SessionControl, SessionMessage, SessionHistory, Cron, or ControlHub capabilities; the same restriction governs snapshots, subagent defaults, manifests, GetToolSpec, deferred Tool admission, and final execution admission
• data and control requests use separate bounded budgets; shutdown bypasses request admission and shares one total deadline across drain, cancel, settlement, and cleanup
• malformed envelopes, event loss, blocked output, and process loss produce typed bounded failures
• a creation task that fails after Core creates a transient Session records the exact Session ID in a connection-owned cleanup ledger; shutdown owns compensation, retains failed entries, and cannot report success while cleanup remains incomplete
• PTY/session ownership is released only after process exit is confirmed
• interfaces/sdk-host is guarded from depending on bitfun-core, terminal-core, concrete services, the SDK Host app, or CLI; the concrete Host may use terminal-core only behind the shared Runtime TerminalPort

CI and test isolation

The Linux/macOS/Windows matrix runs the three terminal-core shutdown and binding regressions changed by this PR. It does not adopt the unrelated full terminal suite: an earlier broad gate exposed five existing Unix exec.rs failures in files this PR does not modify. Fixing those command-control tests is intentionally kept out of the SDK Host scope.

Standalone SDK Host process smokes are added on all three platforms. The Ubuntu crate-test lane continues to run the complete SDK Host/app contract and transport suites.

Independent whole-PR review

Three isolated reviewers audited the final rebased commit from architecture/lifecycle, product/competitor, and protocol/concurrency perspectives. All actionable findings were fixed, including CLI/Host dependency confusion, request concurrency, settlement/cancellation ownership, output failure handling, transient Tool projection, exact-ID cleanup after task failure, protocol envelope classification, and CI coverage.

Final result: P0 = 0, P1 = 0, P2 = 0.

Exact-head verification