feat(events): consolidate IPC and SSE reliability

[luoye520ww]

Problem

IPC and SSE reliability work had been split across several small PRs, making the contracts difficult to review and leaving cursor persistence, gap recovery, cancellation, and projection replay validation disconnected.

Root cause

The renderer and main process had no single bounded contract for IPC errors/cancellation or sequenced runtime events. Resume cursors were not represented as a durable, validated, single-writer state, and event projection lacked deterministic replay/fuzz coverage.

Scope

This PR consolidates the IPC/SSE reliability contracts into one independently testable change. It supersedes the overlapping implementation PRs listed below; it does not wire cancellation into every long-running operation or replace the existing runtime transport.

Changes

• Add bounded AppIpcError and long-operation cancellation envelopes that exclude raw stacks and arbitrary objects.
• Add validated SSE sequence inspection, duplicate/out-of-order/gap classification, and bounded replay versus authoritative reload planning.
• Add a versioned, size-bounded, single-writer resume cursor store with runtime-generation and monotonic-sequence protection.
• Add deterministic chat projection replay/fuzz coverage and focused contract tests.

Safety

• Error payloads are strict, bounded, and primitive-only; stacks are never part of the contract.
• Cursor files are capped at 4 MiB, malformed/oversized data is preserved for diagnostics, and writes use the existing atomic writer.
• Replay is bounded to at most 1,000 events and never mutates projection state directly.
• Runtime generation changes prevent stale cursors from blocking a new stream.

Typecheck

npm.cmd run typecheck
npm.cmd --prefix kun run typecheck

Both passed.

Tests

npm.cmd exec vitest run src/shared/ipc-cancellation.test.ts src/shared/ipc-error.test.ts src/shared/sse-sequence.test.ts src/shared/sse-gap.test.ts src/shared/sse-recovery.test.ts src/main/services/sse-resume-cursor-store.test.ts src/renderer/src/store/chat-projection-reducer.fuzz.test.ts
npm.cmd run lint
npm.cmd run build
git diff --check upstream/develop...HEAD

Results: 7 test files, 32/32 tests passed; lint, build, and diff check passed.

Review performed

• Functional correctness
• Architecture and state ownership
• Concurrency/lifecycle and stale stream handling
• Data integrity and atomic cursor persistence
• Security and bounded error payloads
• Cross-platform TypeScript/build compatibility
• Scope and test quality

PR size

Production files: 7
Test files: 7
Production LOC: 401
Total diff: 907 additions

Non-goals

• This PR does not add transport-specific SSE wiring or UI changes.
• Long-operation cancellation call-site integration remains separate.
• It does not change the runtime event schema already emitted by the Kun server.

Supersedes

• feat(ipc): define safe error envelope #898
• feat(sse): define sequenced event contract #902
• feat(ipc): define cancellation lifecycle contract #904
• feat(sse): detect sequence gaps and stale events #910
• feat(sse): plan bounded gap recovery #911
• feat(sse): persist bounded resume cursors #913
• test(renderer): fuzz chat projection replay invariants #916

Part of the broader reliability work; no issue is auto-closed by this PR.

[XingYu-Zhong]

感谢 IPC/SSE 可靠性方向的投入。关闭当前聚合 PR 的原因是：当前 develop 的运行路径已经具备 ACK/背压、Last-Event-ID 重连、持久事件和有界重放；本 PR 新增的大部分错误、取消、序列恢复和 cursor 合同没有接入真实消费者。

在未接线前一次性固化约 900 行新 API，会增加维护面且与现有实现分叉。

如仍有明确缺口，请基于最新 develop 按一个可验证的行为重开小 PR，例如单独的投影 fuzz 覆盖或已接线的错误 envelope，并同时提交调用方和测试。当前分支会保留。