fix(compression): let explicit interrupts cancel safely (salvage #74449)

[kshitijk4poor]

Summary

Makes interrupt-protected context compression cancellable by an explicit user or lifecycle stop (Ctrl+C, /stop, gateway shutdown), without weakening protection against ordinary incoming messages, voice interjections, or active-turn redirects.

The bug: context compression held the session compression lease while generating its handoff summary. When the user pressed Ctrl+C, interrupt protection kept the summary worker alive after the frontend's grace period. The CLI accepted another turn while that worker still held the lease, and the next persistence operation failed with session storage could not be written.

Based on #74449 by @suparious, cherry-picked with authorship preserved.

Rebase onto current main (2026-08-02)

Rebased onto latest main (was 51 commits behind, CONFLICTING). Repairs made during the rebase — the previous head carried stale-base revert hunks that this update removes:

• restored the message.react RPC handler (7d92056), the kanban session deny-list (e41d202), and the include_row_ids / queued-prompt-generation fixes (d508585) in tui_gateway/methods_session.py — the intrinsic diff there is now only the intended 6-line hard-interrupt change
• restored BedrockAuxiliaryClient.close() (main's _close_cached_client shutdown path calls it)
• resolved gateway/run.py _interrupt_and_clear_session in favor of main's process-reaper flow + request_hard_interrupt

Changes

• agent/interrupt_compat.py (new): request_hard_interrupt() — feature-detected hard_interrupt() with legacy interrupt() fallback (getattr_static so MagicMock/RPC proxies don't fabricate support)
• agent/auxiliary_client.py: AuxiliaryExplicitCancellation (BaseException), _run_protected_sync_provider_call (daemon worker isolation for protected calls only), _AuxiliaryCancellationDecision (atomic cancel/timeout linearization)
• agent/context_compressor.py: try/except around _generate_summary, _last_cooldown_refresh_was_authoritative for rollback
• agent/conversation_compression.py: CompressionCommitFence cancel admission, full rollback path (transcript, compressor state, cooldown, lease)
• run_agent.py: hard_interrupt() method, _hard_interrupt_requested Event, per-agent fence registration
• cli.py, gateway/run.py, acp_adapter/server.py, cron/scheduler.py, tools/delegate_tool.py, tui_gateway/: propagate request_hard_interrupt through all stop surfaces
• hermes_state.py: raw cooldown row get/restore for exact rollback (the active getter filters expired rows and cannot serve as a lossless rollback source)
• Follow-up commit: gateway/run.py _abandon_timed_out_gateway_turn (landed on main after this PR's base, eb4772e) widened to the same hard-stop semantics as every other inactivity-timeout surface in this change

Validation

	Result
PR tests	174 passed
tests/agent -k compress/interrupt/auxiliary	657 passed
tests/run_agent	1311 passed (1 failure reproduces on clean upstream/main — pre-existing)
tests/tui_gateway	327 passed
Mutation check (revert auxiliary_client.py to main)	12/13 new tests fail → tests bind the fix
E2E smoke (real AIAgent + SessionDB, worktree imports)	cancel unblocks in 0.017s, lease released, session writable, shared client untouched
ruff	clean

Closes #74449

[alt-glitch]

This was generated by AI during triage.

Related: #74449 is the open predecessor. This current-head salvage preserves its explicit-stop compression repair while resolving current-main conflicts in the pre-LLM feasibility and TUI interrupt paths; review should choose the current salvage versus the now-dirty predecessor.