Simplify session outcomes and add bounded Executions

[areshand]

Summary

• make deployed runbook bytes authoritative and derive operation versions from live prod-mcp capabilities
• seal Sessions as succeeded, failed, or review_requested; failed sub-agent and operation attempts are terminal until the orchestrator explicitly chooses a distinct retry
• introduce Execution as a runtime-local authority step inside the existing Session loop, without adding a Session Manager entity, Pod, Job, or second supervisor
• keep the durable Thread lifecycle as an internal Control Server module rather than a standalone package or service
• start authenticated user Sessions read-only; let the Supervisor activate one bounded Execution for exact source paths and/or reviewed-ops while the orchestrator itself remains read-only
• let mechanically read-only work complete directly without an independent model reviewer
• keep Slack Sessions permanently observe-only; approval creates a fresh user Session with only the fixed reviewed effects, while rejection closes the Thread
• default gateway-created Sessions to user/read-only and choose the headless fallback route from the current Execution at exit time

Validation

• cargo test --locked --package multiagent --no-fail-fast (93 passed)
• npm test in control-server (60 passed)
• npm test in client (24 passed)
• npm test in slack-ingress (5 passed)
• system-Bash tests/lifecycle.sh, including read-only completion, bounded activation, no widening, and external observe denial
• system-Bash tests/run.sh, including mock orchestration E2E
• cargo fmt --all and git diff --check
• latest GitHub Framework contract checks pass on Python 3.8/3.13, Ubuntu, and macOS