feat(agent): production-grade interactive runtime

[gold-silver-copper]

Summary

This PR delivers a broad foundation and partial implementation of the production interactive-agent roadmap in #2118. It does not complete the epic or every linked issue.

Implemented scope

Interactive runtime

• Adds run-scoped RunControlHandle/RunContext with status, cooperative cancellation, deadlines, steering, follow-ups, safe checkpoints, and resume.
• Uses the shared unary/streaming drive loop so those control semantics remain aligned across both surfaces.
• Propagates run identity, cancellation, deadlines, and call ancestry through native tools, MCP tools, nested dispatch, and child agents.
• Preserves normalized and raw terminal metadata through completions, streams, final responses, checkpoints, and session events for the provider paths covered here.

Tool platform

• Adds hook-aware scoped nested execution with inherited extensions, parent/child internal IDs, allowlists, depth limits, recursion guards, cancellation, and telemetry.
• Adds call-scoped scratchpads, structured error extensions, a public hook test harness, bounded argument repair/retry, scheduling metadata, and final-result tools.
• Adds an ordered host-facing catalog projection for native, MCP, dynamic, and provider-hosted tools while keeping host metadata off provider wires.
• Adds ToolDefinition::output_schema and structured rich tool output parts while retaining string-returning tool compatibility.
• Wires provider-hosted tools through AgentBuilder; OpenAI request conversion merges hosted and native tools into one wire array.

Persistence and reusable capabilities

• Adds durable SQLite ConversationMemory with atomic multi-connection ordering.
• Adds a backend-neutral typed, branchable session event-store API and SQLite implementation with checkpoints, interruption recovery, compaction/bookmarks, import/export, and call correlation.
• Adds a provider-independent progressive-disclosure skill catalog, trusted filesystem discovery, provenance/assets, and per-turn/nested-tool restrictions.
• Adds bounded child-agent orchestration with fresh/inherited history, shared cancellation/deadlines, typed handoffs, progress/status, and parent/session correlation.

Coding-tool foundation

• Adds runtime-independent code-execution contracts and a hardened allowlisted local command backend with process-tree termination, bounded output capture, artifact references, protected paths, mutation queues, and command-configured SSH/container/sandbox adapters.
• Adds a runnable durable_coding_agent example.

What this PR does not complete

The following #2118 work remains and should be handled in focused follow-ups:

• a distinct next_turn queue/API separate from steer and follow-up;
• run-scoped tool/toolset factories with deterministic lifecycle cleanup;
• complete normalized finish-reason mappings across every provider covered by Expose streaming terminal metadata #1886;
• the typed native/MCP host-dispatch design requested by feat: host-facing ToolRegistry with typed native and MCP catalog entries #1906 (this PR adds catalog metadata and unified erased dispatch, not typed native dispatch);
• full Agent Skills/SKILL.md-standard frontmatter and asset-loading semantics;
• a general tool-progress event channel beyond the code/subagent interfaces;
• concrete isolation-enforcing SSH/container/sandbox implementations rather than command-configured adapters;
• a real code-mode runtime that exposes selected Rig tools as callable functions inside JavaScript, Python/Monty, Lua, or WASM. The CodeModeTool in this PR is an allowlisted command-execution foundation, not completion of feat: Add a "Code Mode" tool to Rig #1439;
• the focused child-issue decomposition and migration work requested by the epic.

Accordingly, this PR advances but does not close #2118, #2095, #1906, #1264, #1439, or #1886.

Breaking API migration

The implemented output-schema and correlation work adds fields to public response/tool types. CHANGELOG.md documents struct-literal migration and constructors/helpers. Serialized checkpoint/session fields use defaults where backward deserialization is safe.

Validation

• cargo test -p rig-core --all-features --lib — 1303 passed, 8 ignored
• cargo test -p rig-sqlite --lib — 56 passed
• cargo check --workspace --all-targets --all-features
• cargo check -p rig-core --target wasm32-unknown-unknown
• cargo check -p rig-core --features wasm --target wasm32-unknown-unknown
• cargo clippy -p rig-core --all-targets --all-features -- -D warnings
• cargo clippy -p rig-sqlite --lib --all-features -- -D warnings
• cargo doc -p rig-core -p rig-sqlite --no-deps
• cargo check --manifest-path examples/durable_coding_agent/Cargo.toml
• cargo fmt --all -- --check
• git diff --check
• GitHub CI: fmt, WASM, clippy, tests, doctests, and docs all pass

Live provider and external SSH/container/sandbox execution remain environment-dependent. Windows process-tree cleanup uses the host's taskkill /T /F.

Supersedes the steering approach in #1858. It does not fully supersede #1886.

Closes #2116
Closes #2090
Closes #2094
Closes #1613
Closes #1890
Closes #1968