feat(cli): add opt-in shared TUI runtime

[limityan]

Summary

• add explicit bitfun --shared and bitfun chat --shared modes while keeping Embedded TUI as the default
• let multiple TUI processes reuse one workspace Agent Runtime through a private, local-only IPC adapter
• support the first interactive slice: Session list/create/restore, transcript restore, Turn submit/cancel, Permission, and UserInput
• preserve one Runtime owner; the CLI adapter does not depend on SDK Host or create a second Session/Tool/Permission implementation

Lifecycle and safety

• enforce one controlled Session per connection, one controller per Session, and one active Turn per connection
• on disconnect, release control only after the exact Turn terminal; otherwise quarantine the lease
• keep Shared /exit and /clear open until cancellation reaches a terminal event, without hiding cancellation failures
• preserve one absolute request-frame deadline across outbound events and fail closed when authoritative event delivery is lost
• reuse the existing process-wide Job owner and start the normal 30-second idle window immediately after an invalidated stream enters quarantine
• return a clear Embedded TUI handoff when a restored transcript exceeds the current 8 MiB Shared response limit

Scope boundaries

• Shared remains opt-in and interactive-TUI-only; default Embedded behavior is preserved, including empty-history recovery when transcript loading fails
• Headless CLI, ACP, SDK Host, GUI, Peer, and Remote keep their existing deployment and protocol
• no replay, observer, controller transfer, Session delete/fork, transcript paging, or public IPC/SDK contract
• the final change remains one commit, 42 files, and 4,974 added lines

Validation

• cargo test -p bitfun-agent-runtime-ipc --lib (25 passed)
• cargo test -p bitfun-services-core --features runtime-ownership --test runtime_ownership_contracts (2 passed)
• cargo test -p bitfun-cli (354 unit tests and 37 integration tests passed)
• cargo check --workspace
• node scripts/check-core-boundaries.mjs
• BITFUN_BOUNDARY_CHECK_SELF_TEST=1 node scripts/check-core-boundaries.mjs
• pnpm run check:repo-hygiene
• git diff --check
• independent full-PR architecture, lifecycle, and product reviews: no remaining P0/P1/P2 findings

cargo fmt --all -- --check remains blocked by pre-existing formatting drift in unrelated main-branch files; every Rust file changed by this PR was formatted directly.