feat: own Codex, ACP and Claude room lifecycles through one retained-room contract

[bandzalkin]

Why

Native adapter rooms must retain their conversation identity, workspace, settings and concrete process ownership through interrupted startup, failed cleanup and restart. Independent lifecycle implementations could lose a live handle or admit replacement work before closure was confirmed.

This is the ownership stage of INT-1768, building on the shared retention foundation from #781.

What

• Compose Codex, Claude SDK, OMP ACP, Cursor ACP and Copilot ACP rooms with one shared RetainedRoom/RoomRetention contract. Accepted prompt and settings work is enrolled before it runs and leased through native work and reporting.
• Fence admission immediately on leave or stop, give accepted work its configured settle grace, then cancel and join it. Detached turns cancelled by final cleanup report their outcome once. Ordinary ACP prompts also participate in direct adapter cleanup.
• Retain processes, workspace claims and native continuation through failed, cancelled or timed-out startup and close. Concurrent cleanup joins one attempt; retry and restart finish the previous owner's cleanup before replacement.
• Keep strict restore separate from bootstrap/crash fallback, preserving native identity and effective settings. Route Codex requests by native origin and reject stale-generation callbacks; Claude uses one continuous native reader per room.
• Share one reporting deadline across room and MCP shutdown. A common real-subprocess contract suite exercises all five provider profiles, with focused regressions for provider protocol and cancellation behavior.

Scope

Idle retention remains disabled for every profile, and provider activity remains UNKNOWN. Configuration validation and the shared owner reject idle release before provider callbacks run. Native safety qualification and live suspension acceptance are required for future enablement; they are separate from merging this gated ownership stage.

Public changes: ACP cleanup_all no longer accepts final, and stopped adapters refuse turns until on_started completes restart. ACP start_timeout_s is replaced by retention.transition_timeout_s. All three provider families share a non-negative turn_settle_timeout_s. Unused room-scoped DecisionRegistry methods and its register_minted room argument are removed; OMP_CWD_FLAG centralizes the OMP workspace flag.

#710 and #711 are incorporated and closed as superseded. No Rust core, platform, Fern or new dependency changes are included.

Separate follow-ups: INT-1785 for detached-turn release/cancel consolidation, INT-1786 for remaining test-file splits, and INT-1787 for shared test barriers.

[AlexanderZ-Band]

Full-PR cycle 2: no new verified in-scope findings across all six review groups; converged. Cycle 1’s ACP cleanup issue and documentation nit are fixed and their threads resolved. Full unit validation: 8,673 passed, 115 skipped; pre-commit, type checking and 34 executable-doc checks passed. Idle retention remains disabled; native qualification and live enablement acceptance are separate gates.

[AlexanderZ-Band]

Reviewed the complete gated ownership change in two full-PR cycles. The ACP direct-cleanup defect and documentation nit are fixed, all 237 threads are resolved, and CI plus the full local validation are green at 400a4de. Idle retention remains disabled.