fix(session): port conservative input latch and quit stamping from main (0046 M3.4)

[yicheng47]

0046 M3.4 — closes the M3 session-hardening slice. Ports main's f926581 (restore conservative input latch, impl 0041) and c5b1ce4 (stamp native macOS quits).

What ported

• Conservative local-input latch restored in the session manager: input classification (set/clear/activity), latch state transitions, and the in-band clear signal — with the router consumers documented as deferred to the router/inbox slice (that group is not yet ported; the latch's session-manager half stands alone).
• Native quit stamping: both in-loop quit paths stamp live sessions for launch-resume claim finalization (cb32720, ported in M3.2) and now report aggregated teardown errors before the final fallback retry.
• Reviewer-caught trap documented in the impl log: quit stamps accumulate as an undrained PENDING backlog — inert today; the launch-queue slice must drain/discard the backlog or impose a cutoff before enabling auto-resume.

Deferrals

• f926581's router hunks → router/inbox slice (dependencies unported).
• Frontend half (InboxBlockedPill, MissionWorkspace) → mission-workspace UI; pill design lives in design/runner-mission.pen as a component.

Also in this PR

• docs: decision 10 (nightly channel — gated on M4, separate bundle id/Sparkle feed, month of dogfood), M3.4 log entry, and the queued sequence (crate renames → M3.5 runtimes → start-chat modal + pane controls).

Verification

• make verify green: 440 runner-app tests, native tests, clippy -D warnings, fmt, 10/10 terminal fixtures.
• Codex-peer review: one must-fix round (backlog documentation), re-review clean with independently re-run gates.

🤖 Generated with Claude Code