feat(v0.1): runner Job 直接挂载 per-session PVC + env 透传

PR C 起步：k8s-job.ts 加 sessionPvc volume + env passthrough

- src/runner/k8s-job.ts: 新 RunnerSessionPvcOptions 接口；manifest 多渲染
  agentrun-sessions volume + volumeMount；env 多透传 AGENTRUN_SESSION_PVC_NAME /
  _NAMESPACE / _MOUNT_PATH / AGENTRUN_CODEX_ROLLOUT_SUBDIR
- src/mgr/kubernetes-runner-job.ts: run 引用 session 时查 session storage
  kind=pvc 自动构造 sessionPvc 透传给 manifest 渲染；kind=evicted 已在
  PR B 短路返回 session-store-evicted
- selftest: 1 新 case runner-k8s-job-session-pvc-volume-and-env 验证 PVC volume
  + env 全套透传

后续 PR C 剩余：src/backend/codex-stdio.ts emit codex-rollout-storage-mounted
事件 + session-store-evicted 升级；3 个 codex-stdio 端到端 case。

src/selftest/cases/20-runner-k8s-job.ts

@@ -153,7 +153,49 @@ console.log(JSON.stringify({ apiVersion: manifest.apiVersion, kind: manifest.kin
     } finally {
       await new Promise<void>((resolve) => serverWithKubectl.server.close(() => resolve()));
     }
-    return { name: "runner-k8s-job", tests: ["runner-k8s-job-dry-run", "runner-k8s-job-deepseek-profile-dry-run", "runner-k8s-job-minimax-m3-profile-dry-run", "runner-k8s-job-create-api", "runner-k8s-job-retention-ttl", "runner-job-transient-env", "runner-job-tool-credential-env", "runner-job-unidesk-ssh-tool-credential-env", "runner-job-unidesk-ssh-transient-env-denied"] };
+    const sessionRunRecord: RunRecord = {
+      id: "run-selftest-session-pvc",
+      tenantId: "unidesk",
+      projectId: "pikasTech/unidesk",
+      workspaceRef: { kind: "host-path", path: context.workspace },
+      sessionRef: { sessionId: "sess-selftest-runner-001" },
+      resourceBundleRef: null,
+      providerId: "G14",
+      backendProfile: "codex",
+      executionPolicy: { sandbox: "workspace-write", approval: "never", timeoutMs: 15_000, network: "default", secretScope: { allowCredentialEcho: false, providerCredentials: [{ profile: "codex", secretRef: { name: "agentrun-v01-provider-codex", keys: ["auth.json", "config.toml"] } }] } },
+      traceSink: null,
+      status: "pending",
+      terminalStatus: null,
+      failureKind: null,
+      failureMessage: null,
+      createdAt: new Date().toISOString(),
+      updatedAt: new Date().toISOString(),
+      claimedBy: null,
+      leaseExpiresAt: null,
+    };
+    const sessionPvcRendered = renderRunnerJobDryRun({
+      run: sessionRunRecord,
+      commandId: "cmd-selftest-session-pvc",
+      managerUrl: server.baseUrl,
+      image: "127.0.0.1:5000/agentrun/agentrun-mgr-env:self-test",
+      sessionPvc: { pvcName: "agentrun-v01-session-sess-selftest-runner-001", namespace: "agentrun-v01", mountPath: "/home/agentrun/.codex-codex/sessions", codexRolloutSubdir: "sessions" },
+    });
+    const sessionPvcManifest = sessionPvcRendered.manifest as JsonRecord;
+    const sessionPvcSpec = sessionPvcManifest.spec as JsonRecord;
+    const sessionPvcTemplate = sessionPvcSpec.template as JsonRecord;
+    const sessionPvcPodSpec = sessionPvcTemplate.spec as JsonRecord;
+    const sessionPvcContainers = Array.isArray(sessionPvcPodSpec.containers) ? sessionPvcPodSpec.containers as JsonRecord[] : [];
+    const sessionPvcMounts = Array.isArray(sessionPvcContainers[0]?.volumeMounts) ? sessionPvcContainers[0].volumeMounts as JsonRecord[] : [];
+    const sessionPvcVols = Array.isArray(sessionPvcPodSpec.volumes) ? sessionPvcPodSpec.volumes as JsonRecord[] : [];
+    assert.ok(sessionPvcMounts.some((m) => m.name === "agentrun-sessions" && m.mountPath === "/home/agentrun/.codex-codex/sessions" && m.readOnly === false), "session pvc volume mount must be present");
+    assert.ok(sessionPvcVols.some((v) => typeof v === "object" && v !== null && (v as JsonRecord).persistentVolumeClaim !== undefined && ((v as JsonRecord).persistentVolumeClaim as JsonRecord).claimName === "agentrun-v01-session-sess-selftest-runner-001"), "session pvc volume must reference the per-session PVC");
+    const sessionPvcEnv = Array.isArray(sessionPvcContainers[0]?.env) ? sessionPvcContainers[0].env as JsonRecord[] : [];
+    const envMap = new Map(sessionPvcEnv.map((e) => [String(e.name), String(e.value)]));
+    assert.equal(envMap.get("AGENTRUN_SESSION_PVC_NAME"), "agentrun-v01-session-sess-selftest-runner-001");
+    assert.equal(envMap.get("AGENTRUN_SESSION_PVC_NAMESPACE"), "agentrun-v01");
+    assert.equal(envMap.get("AGENTRUN_SESSION_PVC_MOUNT_PATH"), "/home/agentrun/.codex-codex/sessions");
+    assert.equal(envMap.get("AGENTRUN_CODEX_ROLLOUT_SUBDIR"), "sessions");
+    return { name: "runner-k8s-job", tests: ["runner-k8s-job-dry-run", "runner-k8s-job-deepseek-profile-dry-run", "runner-k8s-job-minimax-m3-profile-dry-run", "runner-k8s-job-create-api", "runner-k8s-job-retention-ttl", "runner-job-transient-env", "runner-job-tool-credential-env", "runner-job-unidesk-ssh-tool-credential-env", "runner-job-unidesk-ssh-transient-env-denied", "runner-k8s-job-session-pvc-volume-and-env"] };
   } finally {
     await new Promise<void>((resolve) => server.server.close(() => resolve()));
   }