feat(v0.1): add per-session RWO PVC foundation for true session state persistence

PR A for #770: docs + migration 007 + RBAC + types foundation.

- 新增 failureKind session-store-evicted，用于区分 PVC 缺失与真协议错误
- 新增 migration 007_v01_session_state_storage：sessions 表增加 storage_* 列 + 索引
- mgr SA RBAC 增量：persistentvolumeclaims: [create, get, list, watch, delete]
- 6 份 SPEC 升级（runtime-assembly / hwlab-manual-dispatch / backend-codex T7b / agentrun-runner / agentrun-mgr / services）
- 显式禁止：fake app-server mock、replacement threadId、runner 启动后 copy/restore、idleTimeoutMs 拉永驻
- selftest 断言更新到 007_v01_session_state_storage

后续 PR B/C 在此基础上接入 mgr 端 PVC 生命周期 + runner 端 mount + backend 端 observability。

src/mgr/postgres-store.ts

@@ -175,6 +175,26 @@ CREATE INDEX IF NOT EXISTS agentrun_sessions_version_idx ON agentrun_sessions (v
 CREATE INDEX IF NOT EXISTS agentrun_runs_session_idx ON agentrun_runs ((session_ref->>'sessionId'), updated_at DESC);
 `;
 
+const sessionStateStorageMigrationSql = `
+ALTER TABLE agentrun_sessions ADD COLUMN IF NOT EXISTS storage_kind text NOT NULL DEFAULT 'none';
+ALTER TABLE agentrun_sessions ADD COLUMN IF NOT EXISTS storage_pvc_name text;
+ALTER TABLE agentrun_sessions ADD COLUMN IF NOT EXISTS storage_namespace text;
+ALTER TABLE agentrun_sessions ADD COLUMN IF NOT EXISTS storage_size_bytes bigint;
+ALTER TABLE agentrun_sessions ADD COLUMN IF NOT EXISTS storage_files_count integer;
+ALTER TABLE agentrun_sessions ADD COLUMN IF NOT EXISTS storage_sha256 text;
+ALTER TABLE agentrun_sessions ADD COLUMN IF NOT EXISTS storage_updated_at timestamptz;
+ALTER TABLE agentrun_sessions ADD COLUMN IF NOT EXISTS codex_rollout_subdir text NOT NULL DEFAULT 'sessions';
+ALTER TABLE agentrun_sessions ADD COLUMN IF NOT EXISTS storage_pvc_phase text;
+ALTER TABLE agentrun_sessions ADD COLUMN IF NOT EXISTS storage_evicted_at timestamptz;
+
+CREATE INDEX IF NOT EXISTS agentrun_sessions_storage_pvc_idx
+  ON agentrun_sessions (storage_pvc_name)
+  WHERE storage_pvc_name IS NOT NULL;
+
+CREATE INDEX IF NOT EXISTS agentrun_sessions_storage_kind_idx
+  ON agentrun_sessions (storage_kind, expires_at);
+`;
+
 const hwlabManualDispatchMigrationSql = `
 ALTER TABLE agentrun_runs ADD COLUMN IF NOT EXISTS session_ref jsonb;
 ALTER TABLE agentrun_runs ADD COLUMN IF NOT EXISTS resource_bundle_ref jsonb;
@@ -297,6 +317,11 @@ const postgresMigrations: MigrationDefinition[] = [
     checksum: checksumSql(sessionControlMigrationSql),
     sql: sessionControlMigrationSql,
   },
+  {
+    id: "007_v01_session_state_storage",
+    checksum: checksumSql(sessionStateStorageMigrationSql),
+    sql: sessionStateStorageMigrationSql,
+  },
 ];
 
 export function postgresMigrationContract(): JsonRecord {