feat(v0.1): add per-session RWO PVC foundation for true session state persistence

PR A for #770: docs + migration 007 + RBAC + types foundation.

- 新增 failureKind session-store-evicted，用于区分 PVC 缺失与真协议错误
- 新增 migration 007_v01_session_state_storage：sessions 表增加 storage_* 列 + 索引
- mgr SA RBAC 增量：persistentvolumeclaims: [create, get, list, watch, delete]
- 6 份 SPEC 升级（runtime-assembly / hwlab-manual-dispatch / backend-codex T7b / agentrun-runner / agentrun-mgr / services）
- 显式禁止：fake app-server mock、replacement threadId、runner 启动后 copy/restore、idleTimeoutMs 拉永驻
- selftest 断言更新到 007_v01_session_state_storage

后续 PR B/C 在此基础上接入 mgr 端 PVC 生命周期 + runner 端 mount + backend 端 observability。

src/common/types.ts

@@ -22,6 +22,7 @@ export type FailureKind =
   | "provider-invalid-tool-call"
   | "provider-unavailable"
   | "infra-failed"
+  | "session-store-evicted"
   | "cancelled";
 
 export type RunStatus = "pending" | "claimed" | "running" | "completed" | "failed" | "blocked" | "cancelled";

src/mgr/postgres-store.ts

@@ -175,6 +175,26 @@ CREATE INDEX IF NOT EXISTS agentrun_sessions_version_idx ON agentrun_sessions (v
 CREATE INDEX IF NOT EXISTS agentrun_runs_session_idx ON agentrun_runs ((session_ref->>'sessionId'), updated_at DESC);
 `;
 
+const sessionStateStorageMigrationSql = `
+ALTER TABLE agentrun_sessions ADD COLUMN IF NOT EXISTS storage_kind text NOT NULL DEFAULT 'none';
+ALTER TABLE agentrun_sessions ADD COLUMN IF NOT EXISTS storage_pvc_name text;
+ALTER TABLE agentrun_sessions ADD COLUMN IF NOT EXISTS storage_namespace text;
+ALTER TABLE agentrun_sessions ADD COLUMN IF NOT EXISTS storage_size_bytes bigint;
+ALTER TABLE agentrun_sessions ADD COLUMN IF NOT EXISTS storage_files_count integer;
+ALTER TABLE agentrun_sessions ADD COLUMN IF NOT EXISTS storage_sha256 text;
+ALTER TABLE agentrun_sessions ADD COLUMN IF NOT EXISTS storage_updated_at timestamptz;
+ALTER TABLE agentrun_sessions ADD COLUMN IF NOT EXISTS codex_rollout_subdir text NOT NULL DEFAULT 'sessions';
+ALTER TABLE agentrun_sessions ADD COLUMN IF NOT EXISTS storage_pvc_phase text;
+ALTER TABLE agentrun_sessions ADD COLUMN IF NOT EXISTS storage_evicted_at timestamptz;
+
+CREATE INDEX IF NOT EXISTS agentrun_sessions_storage_pvc_idx
+  ON agentrun_sessions (storage_pvc_name)
+  WHERE storage_pvc_name IS NOT NULL;
+
+CREATE INDEX IF NOT EXISTS agentrun_sessions_storage_kind_idx
+  ON agentrun_sessions (storage_kind, expires_at);
+`;
+
 const hwlabManualDispatchMigrationSql = `
 ALTER TABLE agentrun_runs ADD COLUMN IF NOT EXISTS session_ref jsonb;
 ALTER TABLE agentrun_runs ADD COLUMN IF NOT EXISTS resource_bundle_ref jsonb;
@@ -297,6 +317,11 @@ const postgresMigrations: MigrationDefinition[] = [
     checksum: checksumSql(sessionControlMigrationSql),
     sql: sessionControlMigrationSql,
   },
+  {
+    id: "007_v01_session_state_storage",
+    checksum: checksumSql(sessionStateStorageMigrationSql),
+    sql: sessionStateStorageMigrationSql,
+  },
 ];
 
 export function postgresMigrationContract(): JsonRecord {

src/selftest/cases/00-redaction-postgres.ts

@@ -13,7 +13,9 @@ const selfTest: SelfTestCase = async () => {
     (error) => error instanceof AgentRunError && error.failureKind === "infra-failed" && error.message.includes("DATABASE_URL is required"),
   );
   const postgresContract = postgresMigrationContract();
-  assert.equal(postgresContract.latestMigrationId, "006_v01_session_control");
+  assert.equal(postgresContract.latestMigrationId, "007_v01_session_state_storage");
+  assert.equal((postgresContract.migrationIds as string[]).includes("007_v01_session_state_storage"), true);
+  assert.ok(typeof (postgresContract.checksums as Record<string, string>)["007_v01_session_state_storage"] === "string" && (postgresContract.checksums as Record<string, string>)["007_v01_session_state_storage"].length > 0);
   assert.equal((postgresContract.checksums as Record<string, string>)["002_v01_backend_profiles"], "928b5c490cc4539cb64ecef34784557601b2724fa2870570f16a53576804e49c");
   assert.ok(Array.isArray(postgresContract.requiredTables));
   assert.ok(postgresContract.requiredTables.includes("agentrun_schema_migrations"));