feat(cu): add runtime observation and action leases

[hqhq1025]

Stack position

PR B, stacked on codex/cu-foundation-core (upstream draft PR apache#857).

This fork-local PR preserves the real stacked diff because the upstream repository cannot use a fork branch as a PR base. After apache#857 merges, this branch will be retargeted to maka-agent/main and opened upstream.

Summary

Adds the provider-neutral Runtime layer without adding a native executor, Desktop wiring, provider adapter, or cursor presentation.

• one-shot frame/epoch observations and canonical action fingerprints;
• capture-local window binding for coordinate actions;
• semantic element identity binding;
• per-session invocation queues without global serialization;
• session generation leases for intervention, lock, re-observe, blocked URL, and user stop;
• stale/replay/duplicate action rejection;
• fresh full observation requirement after every mutation;
• unknown dispatch outcome requires re-observation;
• same-turn terminal tombstones with explicit new-turn recovery;
• privacy split between persisted summaries and provider-visible AX/screenshot state;
• model-visible screenshot output through the generic tool result mapping.

Codex lab alignment

• maxInFlight: 1 is implemented per Computer Use session, not globally;
• approval does not create an active session: actions require a successful observation;
• unrelated dynamic AX/DOM changes do not synthesize user intervention;
• physical intervention, lock, blocked URL, and user stop invalidate old leases;
• ambiguous/stale semantic identity remains an executor responsibility and must fail closed;
• raw AX labels, values, window titles, and app inventory do not enter persisted tool results.

Non-goals

• cua-driver transport and service lifecycle;
• page/element refetch implementation;
• Desktop event producers;
• provider-specific scaling or native tools;
• cursor/PiP presentation;
• real-model E2E.

Verification

• focused Computer Use Runtime tests: 55/55;
• Runtime full test: 1420 passed, 2 skipped, 0 failed;
• Core: 833/833;
• UI: 125/125;
• Desktop: 2384/2385 in the aggregate run; the only Rive child-process timeout passed 10/10 on immediate isolated rerun;
• full repository build passed;
• full repository typecheck passed;
• adversarial review findings for lock recovery, queued keyboard actions, clearSession tombstones, and app-title persistence were fixed and covered by regression tests.

[hqhq1025]

The exact net diff represented here is now published upstream as apache#892. Closing this fork-local review PR to keep the active review queue in the upstream repository.