fix: harden tool controls and persisted handoffs

[skhaz]

Malformed tool controls can crash a Session turn, and a Stop committed while the next agent builds its prompt can still start another provider request. Validate controls before their effects, pass a current-state Stop callback into Agent, and stop continuation when Agent reports it stopped.

• Return reader refresh failures after durable writes so the command bus closes without replaying committed effects or continuing with stale state.
• Reuse metadata ownership reads, scope updates to the owning session, and report zero-row updates for missing or moved records.
• Add real runtime handoffs with deterministic providers and persisted context/config/history checks. Cover pending retirement during tools and prompt construction, cancellation of retirement, stale finish requests, explicit Stop after retirement, malformed peer results, and cleanup after fixture failures.
• Integrate current master, preserving fix(session): drain accepted work before lifecycle retirement #65's drain-before-retirement behavior. Tests assert Session exit and registry-name cleanup before deleting fixture rows.
• Add a required PostgreSQL 17 CI job for persistence and handoffs, alongside locked-dependency compatibility, candidate runtime, and lint jobs. Pin Framework to 7a485e9b59fc4d59720104bf55157adb3a01a386.
• Keep test artifacts outside the checkout; retain opt-in local benchmarks without a CI timing threshold.

Validation on Wippy v0.3.48a:

• Published dependencies: 640 passed, 4 explicitly skipped (2 benchmarks and 2 Stop-boundary cases requiring newer Framework).
• Current Framework: 642 passed, 2 benchmark skips; lint passed.
• Required SQLite runtime target: 11/11 passed, with nonempty-case enforcement.
• PostgreSQL persistence and runtime target: 43/43 passed, with nonempty-case enforcement. Afterward: zero session/message/context fixture rows, zero test connections, and no leftover trigger functions.

Release and publication remain separate.