feat(v0.1): add per-session RWO PVC foundation for true session state persistence

PR A for #770: docs + migration 007 + RBAC + types foundation.

- 新增 failureKind session-store-evicted，用于区分 PVC 缺失与真协议错误
- 新增 migration 007_v01_session_state_storage：sessions 表增加 storage_* 列 + 索引
- mgr SA RBAC 增量：persistentvolumeclaims: [create, get, list, watch, delete]
- 6 份 SPEC 升级（runtime-assembly / hwlab-manual-dispatch / backend-codex T7b / agentrun-runner / agentrun-mgr / services）
- 显式禁止：fake app-server mock、replacement threadId、runner 启动后 copy/restore、idleTimeoutMs 拉永驻
- selftest 断言更新到 007_v01_session_state_storage

后续 PR B/C 在此基础上接入 mgr 端 PVC 生命周期 + runner 端 mount + backend 端 observability。

src/common/types.ts

@@ -22,6 +22,7 @@ export type FailureKind =
   | "provider-invalid-tool-call"
   | "provider-unavailable"
   | "infra-failed"
+  | "session-store-evicted"
   | "cancelled";
 
 export type RunStatus = "pending" | "claimed" | "running" | "completed" | "failed" | "blocked" | "cancelled";