feat(harness): authority, turn contract, tools, clean_agent_preview

Chat/agent harness work: request-authority model, turn contract, tool
policy/parsing/execution, clean_agent_preview streaming/thinking, ask_user
persistence, session probes, and scheduler.

Source: vendor/photocraft (ad1cff44) harness files, 3-way merged onto
upstream/dev (a8c147b2). Harness core files were independently developed
in both lineages; resolution policy documented in pr_work/C_conflicts.md
(vendor kept where ahead, upstream kept where vendor is behind; full delta
preserved in pr_work/C_upstream_delta.patch).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_auth_session_persistence.py

@@ -0,0 +1,31 @@
+"""A valid login session cookie must survive a deploy restart of the server.
+
+AuthManager keeps tokens in memory but persists them to sessions.json on create
+and reloads them at startup, so a restart must NOT log the user out (the 302 the
+bench saw was the restart gap / a client-side artifact, not session loss).
+"""
+from core import auth
+
+
+def test_session_token_survives_a_restart(tmp_path):
+    auth_path = str(tmp_path / "auth.json")
+    first = auth.AuthManager(auth_path)
+    assert first.create_user("pewds", "hunter2", is_admin=True)
+    token = first.create_session_trusted("pewds")
+    assert token and first.validate_token(token)
+
+    # Simulate a process restart: a brand-new AuthManager on the same data dir.
+    second = auth.AuthManager(auth_path)
+    assert second.validate_token(token) is True
+    assert second.get_username_for_token(token) == "pewds"
+
+
+def test_revoked_token_does_not_survive_restart(tmp_path):
+    auth_path = str(tmp_path / "auth.json")
+    first = auth.AuthManager(auth_path)
+    first.create_user("pewds", "hunter2", is_admin=True)
+    token = first.create_session_trusted("pewds")
+    first.revoke_token(token)
+
+    second = auth.AuthManager(auth_path)
+    assert second.validate_token(token) is False