feat(v0.1): runner Job 直接挂载 per-session PVC + env 透传

PR C 起步：k8s-job.ts 加 sessionPvc volume + env passthrough

- src/runner/k8s-job.ts: 新 RunnerSessionPvcOptions 接口；manifest 多渲染
  agentrun-sessions volume + volumeMount；env 多透传 AGENTRUN_SESSION_PVC_NAME /
  _NAMESPACE / _MOUNT_PATH / AGENTRUN_CODEX_ROLLOUT_SUBDIR
- src/mgr/kubernetes-runner-job.ts: run 引用 session 时查 session storage
  kind=pvc 自动构造 sessionPvc 透传给 manifest 渲染；kind=evicted 已在
  PR B 短路返回 session-store-evicted
- selftest: 1 新 case runner-k8s-job-session-pvc-volume-and-env 验证 PVC volume
  + env 全套透传

后续 PR C 剩余：src/backend/codex-stdio.ts emit codex-rollout-storage-mounted
事件 + session-store-evicted 升级；3 个 codex-stdio 端到端 case。

src/mgr/kubernetes-runner-job.ts

@@ -6,7 +6,7 @@ import type { AgentRunStore } from "./store.js";
 import type { JsonRecord } from "../common/types.js";
 import { stableHash, validateEnvName } from "../common/validation.js";
 import { renderRunnerJobManifest } from "../runner/k8s-job.js";
-import type { RunnerTransientEnv } from "../runner/k8s-job.js";
+import type { RunnerSessionPvcOptions, RunnerTransientEnv } from "../runner/k8s-job.js";
 
 const reusableCredentialEnvNames = new Set([
   "AUTH_PASSWORD",
@@ -75,14 +75,18 @@ export async function createKubernetesRunnerJob(options: { store: AgentRunStore;
   }
   if (isTerminalRunStatus(run.status)) throw new AgentRunError(run.failureKind ?? (run.status === "cancelled" ? "cancelled" : "schema-invalid"), `run ${run.id} is already terminal: ${run.status}`, { httpStatus: 409 });
   if (isTerminalCommandState(command.state) || command.state !== "pending") throw new AgentRunError(command.state === "cancelled" ? "cancelled" : "schema-invalid", `command ${commandId} is not pending: ${command.state}`, { httpStatus: 409 });
+  let sessionPvc: RunnerSessionPvcOptions | undefined;
   if (run.sessionRef?.sessionId) {
     const session = await options.store.getSession(run.sessionRef.sessionId);
     if (session?.storageKind === "evicted") {
       throw new AgentRunError("session-store-evicted", `session ${session.sessionId} storage has been evicted; create a new sessionId`, { httpStatus: 409, details: { sessionId: session.sessionId, pvcName: session.storagePvcName ?? null, pvcPhase: session.storagePvcPhase ?? null, valuesPrinted: false } });
     }
+    if (session?.storageKind === "pvc" && session.storagePvcName) {
+      const subdir = session.codexRolloutSubdir ?? "sessions";
+      sessionPvc = { pvcName: session.storagePvcName, namespace: session.storageNamespace ?? "agentrun-v01", mountPath: `/home/agentrun/.codex-${run.backendProfile}/${subdir}`, codexRolloutSubdir: subdir };
+    }
   }
-
-  const renderOptions = {
+  const renderOptions: Parameters<typeof renderRunnerJobManifest>[0] = {
     run,
     commandId,
     managerUrl,
@@ -91,6 +95,7 @@ export async function createKubernetesRunnerJob(options: { store: AgentRunStore;
     sourceCommit,
     transientEnv,
     ...(serviceAccountName ? { serviceAccountName } : {}),
+    ...(sessionPvc ? { sessionPvc } : {}),
   };
   const attemptId = optionalString(options.input.attemptId);
   const runnerId = optionalString(options.input.runnerId);