Add runnable Pi session service

[c0da-ricon]

Summary

• port the proven Grow Heal Love agent-service shape into a generic runnable Stein service
• organize Pi session lifecycle, conversation state, private visible-history persistence, and OpenAI-compatible transport as separate dependency layers
• replace the test-only SDK facade with direct Pi 0.83 session construction and higher-level deterministic seams
• add a thin TypeScript mise run serve adapter with explicit model, prompt, workspace, agent, session, token, and listen inputs
• provide authenticated OpenAI/Open WebUI streaming with per-conversation serialization, history-continuity checks, cancellation, and failure cleanup
• disable tools, extensions, skills, prompt templates, themes, and ambient context; reject missing models and fallback initialization
• create session storage with mode 0700 and atomic history/session artifacts with mode 0600

Validation

• mise run check
  • strict TypeScript checking
  • 35/35 deterministic model-free Bun tests
  • 6/6 configured Codebase lints
  • whitespace check
• real local service smoke with explicit openai-codex/gpt-5.6-luna
  • streamed exactly STEIN_SMOKE_OK through /v1/chat/completions
  • persisted Pi JSONL and visible history at mode 0600
  • stopped the server, verified no listener remained, and deleted the private temporary workspace
• signed commit and pre-push checks passed

Boundary

This PR ports reusable runtime behavior, not Grow Heal Love product policy or private data. It does not add deployment, ambient credentials, tools, prompt content, or a dependency from GHL back to Stein. The live smoke used temporary local files only and left no service or model artifacts running.

Self-review correction

Adversarial review found that the Pi JSONL could advance before visible conversation history committed. A model failure, client abort, or visible-history save failure could therefore leave an abandoned turn active when the conversation retried.

The service now checkpoints the current Pi leaf before each turn and treats visible-history persistence as the commit boundary. Any pre-commit failure aborts the turn, branches or resets back to the checkpoint, appends a plain stein.turn_rollback marker, and disposes the failed session before allowing a clean retry. Rollback failure preserves the original turn failure for diagnosis.

Focused coverage proves model failure, active abort, visible-history save failure, prior-leaf and null-root rollback, and a real SessionManager reopen where the abandoned branch is inactive and the rollback marker is absent from model context. The refreshed full gate passed strict TypeScript, 40/40 tests, all six Codebase lints, and the whitespace check in 4.910 seconds. A real Luna persistence/retry smoke forced visible-history save failure and verified that a fresh retry answered from empty committed history while the abandoned turn stayed outside reopened model context; all private temporary state was removed.