[codex] Refactor conversation session service boundary

[roackb2]

Summary

Refactors the conversation session boundary so more TUI session behavior goes through ConversationSessionService instead of direct helper or repository access.

Changes include:

• adds service-owned operations for persisted messages, reset, continue prompt, drift setting, and session leases
• changes TUI direct shell, drift, and agent-run controller paths to call the session service for touched session state
• reshapes createConversationSessionService around an internal FileConversationSessionService class with private repository/config/update helpers
• adds unit coverage for service-owned persisted message, reset, drift, continue prompt, and lease semantics
• updates chat-runtime test wiring to use the session service

Notes

This is still a partial TUI boundary slice. Follow-up cleanup is still needed for ordinary-turn and direct-shell compaction paths that continue to own some persisted session semantics in TUI code.

Verification

• yarn typecheck
• yarn lint
• ./node_modules/.bin/vitest run src/__tests__/unit/core/conversation-engine.test.ts src/__tests__/integration/chat/chat-runtime.test.ts

I also previously tried the broader integration script, but it ran unrelated suites and hit local environment failures around git identity and localhost listen permissions.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: de799723ca

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Avoid throwing when persisted session disappears post-turn

After runConversationTurn completes, this now hard-throws if the session record is missing. In multi-client usage, another client can still delete the session during the run (delete does not enforce lease checks), so a completed turn can be misreported as a failed run when require throws and the caller enters the error path. The previous behavior handled this case gracefully by returning early when the session could not be read.

Useful? React with 👍 / 👎.