fix(session): drain accepted work before lifecycle retirement

[wolfy-j]

Disconnect, chat close, inactivity and capacity retirement currently enter the same cancellation path as Stop. A provider returning a tool call after FINISH therefore stores it as cancelled and can leave a document partially edited. Cancelled calls also omit terminal live events, and existing clients reload them as processing.

This change keeps lifecycle retirement pending until the turn and all accepted queued/control/background work have drained. Resume/reopen invalidates pending finish checks; lifecycle controls accept only the owning plugin or the session itself. Stop stays reachable while retirement is pending and retains its existing supervised cancellation behavior.

All live children count toward capacity until EXIT, preventing deferred retirement from creating unlimited children. An auto-started plugin with no sessions exits through normal ticker cleanup on shutdown.

Cancelled public tools emit FUNCTION_ERROR only after durable settlement. Recorded intent types keep private/delegation details out of public events. History retains cancelled in storage and projects status=error with outcome=cancelled for existing clients. UI files are unchanged.

Validation:

• Full session suite: 604 passing cases; includes actual suspended-provider/tool persistence, all four retirement reasons, reconnect, foreign lifecycle controls, explicit Stop, queued controls, live child limits, private events, failed settlement and history response compatibility.
• make lint: clean.
• Companion Relay branch plus Session branch: two additional native smoke cases through the actual relay -> plugin -> session -> provider -> tool path store exactly one edit and release the hub/session registry names.
• Runtime: signed Wippy v0.3.48a. SQLite tested locally; PostgreSQL and a real browser/Word deployment replay were not run.

Companion: wippyai/framework#179

The companion Framework Relay PR replaces idle hub cancellation with cooperative retirement. Deploy both changes for protection beyond Relay's hub inactivity timeout. Existing provider/turn limits and explicit service cancellation/recovery remain in force. The test lock records the published Agent/LLM versions selected by the standard test command; no unpublished behavior/fallback dependencies are added.