feat(pi): adopt telemetry conformance, agent-runtime eval, session fencing, daemon leases, diff renderer core

[Patel230]

Summary

Implements the approved Pi adoption plan (docs/plans/pi-adoption-plan.md), landing the feasible items across hawk:

P0

• Telemetry conformance suite (internal/observability/conformance): typed span/attribute schema + runner-independent conformance harness wired to the real span starters; schema-drift, sensitive-key, and passivity tests. CI now fails on telemetry schema drift.
• Agent-runtime eval harness (internal/feature/evalloop + hawk eval loop): drives the real engine.Session tool loop via an injected ChatClient in an isolated dir, snapshots the transcript, reports events/usage/cost. Runs in CI without external credentials via a mock client.

P1

• Session writer fencing (internal/session): additive Fence metadata field persisted on save/load + FenceOf/SetFence helpers.
• Daemon session leases (internal/daemon): POST/DELETE /v1/sessions/{id}/lease acquire/release single-owner leases with fence enforcement; OpenAPI updated (parity test green).
• Differential renderer core (internal/tui/diff): line-granular diff + synchronized-output emission mirroring pi-tui, fully unit-tested. Full Bubble Tea renderer swap deferred to a runtime-verified follow-up.

P2

• Kitty graphics deferred (requires the render-path follow-up).

Test plan

• Full go test ./... green (twice + via pre-push hook)
• New package tests: conformance, evalloop, diff, daemon lease, session fence
• make vet, make lint, hawk verify green
• Boundary guards, submodule drift, govulncheck passed in pre-push hooks
• markdownlint-cli2 clean on the updated plan doc