feat(cli): add shared session rename and streamline IPC - #1877

Outcome

• Adds /rename <name> for the current Session in both Embedded and Shared TUI.
• Routes both deployments through the existing AgentRuntime::rename_session owner and the public AgentSessionRenameRequest; the private Shared Runtime operation only transports that request.
• Writes only title metadata before publishing the new in-memory name. A failed write restores the previous metadata; an unconfirmed rollback is reported as outcome_unknown instead of a definite failure.
• Removes the older Session-selector inline rename path instead of keeping a second UI state machine.

Deployment and performance boundaries

The IPC client assigns request IDs without cloning the full operation and validates/serializes an outgoing request before writing it. A pre-send encoding or size failure is therefore reported as not executed and keeps the connection usable; a timeout or disconnect after writing remains an unknown outcome and is not retried automatically.

The architecture document adds concise logical, process, development, physical, and rename-scenario views. It also records why the current local Shared Runtime stays a private TUI transport rather than becoming an SDK or general App Server. This follows the separation used by Codex App Server, the long-running process guidance in Claude Agent SDK hosting, and the distinct server/SDK surfaces in OpenCode.

CLI behavior

• /help, the slash menu, and the action registry use one /rename <name> description.
• A rename is rejected while the current Session is busy or another durable Session update is pending.
• The TUI updates its visible name only after Runtime success.
• External command-name collisions keep the existing explicit-choice flow. A BitFun /rename chosen from the slash menu authorizes only the immediately following matching parameter submission; edits, history navigation, another menu selection, or a Session transition clear that one-use choice.
• Embedded and Shared preserve the same typed outcome_unknown fact. Shared transport loss also produces that fact and closes the connection.

Cross-surface consistency

• Desktop and Peer Host preserve outcome_unknown through existing error adapters rather than flattening it into a generic failure.
• The existing Desktop Session list shows a clear warning and reloads only the affected title from authoritative metadata before a user decides whether to retry.
• The readback keeps the current transcript, Runtime state, project workspace, and other UI state unchanged.

Deliberate exclusions

• No Session delete, fork, archive, bulk rename, picker-inline rename, observer, replay, or controller-transfer capability.
• No new public SDK method, public wire protocol, App Server, or universal deployment abstraction.
• No process-per-TUI pool, unbounded queue, broad Session refresh, or second rename owner.

Validation

• cargo check --workspace
• cargo test -p bitfun-agent-runtime-ipc — 36 passed
• cargo test -p bitfun-core title_ --lib — 10 passed
• cargo test -p bitfun-cli modes::chat::tests — 73 passed
• cargo test -p bitfun-cli unknown_outcome — 4 passed
• cargo test -p bitfun-sdk-host unknown_outcome_requires_an_authoritative_read_before_retry — 1 passed
• cargo test -p bitfun-desktop unknown_ — 5 passed
• Web type check and lint — passed
• Changed Web paths — 52 passed
• i18n contract — 37 passed; audit — 0 warnings
• Core boundary and repository hygiene checks — passed
• git diff --check gcwing/main — passed

The full local Web run reached 354 passing suites and 2,350 passing tests. Four unrelated Remote Connect suites could not resolve mobile-web dependencies from the reused worktree dependency directory, and one unchanged source-text contract was line-ending-sensitive on Windows. All changed Web paths passed independently.

Two independent adversarial reviews covered the final complete PR after the fixes above. Both reported no remaining P0, P1, or P2 findings.