…session limit

Wire the box-side test-session resilience through the TS gateway so the consumer
can reach it, aligned with the sicore side.

1. capability.testSessions (src/gateway/server.ts): new RPC method proxying the
   box's GET /test-sessions. Read-only reconciliation — mirrors testClose's box
   discovery and NEVER spawns/rehydrates a box just to list (absent/dead box →
   empty list). Box rows pass through verbatim; the `tid` wire field is
   load-bearing for the consumer and is not renamed. Response:
   {run_id, sessions:[{tid,parent_run_id,created_at,last_activity_at,done}]}.

2. Stable 429 error code (kbc/platform/pod/compile_box.py): the box's
   "too many concurrent test sessions" refusal now returns the structured
   {error:{code,message,retriable:false}} shape (same convention as
   handle_test_recommendation) with code "test_session_limit". The agentbox
   error mapping (agentBoxResponseError → wrapRpcError) passes the code +
   retriable=false through unchanged. Without this a bare 429 mapped to the
   generic TOO_MANY_REQUESTS with retriable=true — indistinguishable from a
   model rate-limit 429 and wrongly retriable. Not retriable by design: the
   caller must close an idle session, not auto-retry.

3. Wire contract (src/gateway/capability/contract.ts): CAPABILITY_TEST_SESSIONS,
   the request/response/summary interfaces, and TEST_SESSION_LIMIT_ERROR_CODE
   documented so the box↔runtime↔consumer contract is single-sourced.

Tests: new src/gateway/server-capability-test-sessions.test.ts (passthrough with
tid preserved / empty on absent box / run_id required); box test asserts the
structured 429 body. tsc --noEmit clean; gateway vitest green; box suite 69
passing.

Two P2 follow-ups from the sicore MR review, layered on the test-session work.

1. testStart idempotency (kbc/platform/pod/compile_box.py + gateway):
   handle_open_test accepts an optional `idempotency_key`. A retried open with
   the same key returns the SAME live session (same tid/snapshot_hash/pages)
   with `idempotent_replay: true`, instead of opening a second session or
   consuming a second concurrency slot — so a lost ack / client retry cannot
   leave a ghost session. Checked before the cap (a replay is never 429'd) and
   before packing (no snapshot work). The key→tid map is process-local and
   cleared with the session on teardown, so a torn-down key opens fresh and can
   never replay a dead tid. Absent key → behavior unchanged (old-consumer compat).
   The gateway's capability.testStart passes the field through and, crucially,
   SKIPS starting a second event relay on an idempotent_replay — the box's
   /test-events is single-consumer, so a duplicate relay would split the stream.

2. Run-scoped listing (gateway): capability.testSessions filters the box's rows
   to the requested run_id. A shared box (SICLAW_COMPILE_BOX_ENDPOINT) hosts
   sessions for multiple parent runs; one run must never see or reap another's.
   Double protection with the consumer's own ParentRunID check.

Field name `idempotency_key` (aligned with sicore). Tests: box test asserts
same-key replay → same tid + replay flag + unchanged active count, different key
→ new session, teardown drops the key (fresh afterwards), no-key never deduped;
gateway test asserts a shared box's two runs are mutually invisible in the list.
tsc --noEmit clean; gateway vitest green; box suite 70 passing.

Follow-up to the testStart idempotency change: the relay-skip guard only fires
on the rare idempotent-replay path, and a future refactor of the testStart
handler could silently drop it — splitting the box's single-consumer
/test-events stream. Extract the decision into a pure predicate
(shouldRelayTestSession) in the relay module and unit-test both branches
(replay → no relay; fresh open or flag absent → relay); the handler now calls
the predicate instead of an inline check. Behavior unchanged. tsc clean;
test-relay vitest green.

Align the testStart idempotency key with sicore (MR!696) and the codebase's
existing convention: every consumer-minted idempotency key here is a `<noun>_id`
(message_id for a turn, command_id for a typed command, operation_id for a
mutation receipt) — there is no `idempotency_key`. So the field is
`client_request_id`, not the `idempotency_key` the first pass used. Behavior is
unchanged: same client_request_id → same live session (checked before the cap and
before packing), empty/absent → open fresh. Box read + TestRun attribute +
teardown cleanup, the gateway request type + passthrough, and the box test's
wire bodies all renamed. box suite 70 green; tsc clean; gateway vitest green.