Add a distinct provider-startup phase to session startup states

[badcuban]

Priority: P3

Follow-up to #15, which covered the startup/provider-status trust work. One acceptance criterion was intentionally left partial: the UI distinguishes backend connection ("Connecting"), thread/session startup ("Starting session"), and provider-status checks (compact banner notices) — but spawning the provider runtime itself (codex app-server / claude process start) is invisible. It is folded into "Starting session" because no provider-runtime event exists between turn dispatch and session.started.

Why

When session startup is slow, the most common culprit is the provider process (binary resolution, spawn, auth handshake) rather than Threadlines itself. A distinct "Starting Codex" / "Starting Claude" phase would tell the user which layer they are waiting on and make the >30s slow-startup notice (added in #15) more actionable. This is polish, not correctness: nothing is broken without it.

Starting points

• packages/contracts/src/providerRuntime.ts — ProviderRuntimeEventType literals; a new event (e.g. session.spawning or runtime.starting) or an extended session.state.changed payload would be defined here. Contracts stay schema-only.
• apps/server/src/provider/Layers/CodexAdapter.ts and ClaudeAdapter.ts — where the provider process is actually spawned; emit the new lifecycle event before session.started.
• apps/server/src/orchestration/Layers/ProviderRuntimeIngestion.ts and ProviderActivityProjection.ts — ingest/project the new event into orchestration domain events.
• apps/server/src/orchestration/decider.ts — session status: "starting" transitions (~L335, ~L631) if we want a sub-state rather than a new activity.
• apps/web/src/session-logic.ts — deriveActiveStatusLabel maps the new signal to a label ("Starting Codex…" vs "Starting session").
• apps/web/src/components/chat/SessionStartupNotice.tsx — the slow-startup notice could name the stuck phase.

Acceptance criteria

• A provider-runtime lifecycle signal distinguishes "provider process starting" from "session starting" without breaking existing event consumers (additive contract change only).
• The chat activity row shows a provider-specific label while the provider runtime is spawning, then transitions to "Starting session".
• The slow-startup notice names the phase it is stuck in.
• Regression coverage: ingestion/projection of the new event, label derivation, and notice text.

Optional / may split out

#15 removed slow-request popups entirely in favor of the Diagnostics page. If passive-only visibility turns out to be too quiet, add a subtle ambient indicator (e.g. a status-bar dot when requests exceed the slow-ack threshold) that links to Diagnostics — explicitly not a toast.