code-mode: make create and observe retry-safe

[cconger]

Why

The session protocol crosses a cancelable IPC boundary. A lost create or observe response must be retryable without starting another cell or consuming output that Core never received.

What

• Add caller-provided idempotency_key fields to the wire CreateCellRequest and ObserveRequest types.
• Reuse the admitted cell for a repeated matching create key.
• Detach host-side observation work from the lifetime of the caller's response future.
• Cache and replay the same ObserveOutcome wire value when an observation key is retried.
• Reject reuse of a key for different request contents.
• Leave the operation-specific outcome unions from code-mode: expose create and observe operations #29291 unchanged.
• Add canceled-create, canceled-observe, and replay contract tests.

Host/Core wire sequence

sequenceDiagram
    participant Core
    participant Host
    Core->>Host: CreateCellRequest { idempotency_key, ... }
    Host-->>Core: CellId
    opt create response is lost
        Core->>Host: same CreateCellRequest
        Host-->>Core: same CellId
    end
    Core->>Host: ObserveRequest { idempotency_key, cell_id, yield_time_ms }
    Host->>Host: finish observation independently
    opt observe response is lost
        Core->>Host: same ObserveRequest
        Host-->>Core: same ObserveOutcome
    end

Loading

Stack boundary

Observation records are keyed independently and retained for the session lifetime in this PR. #29398 replaces arbitrary observation keys with per-cell generations and bounds retention to the latest observation.

Validation

• just test -p codex-code-mode
• just test -p codex-code-mode-protocol
• Contract coverage for canceled and repeated create/observe operations.

Stack parent: #29291.

[jif-oai]

The deadlock is a major blocker

[jif-oai]

We generate a retry key for wait, but the terminate=true branch drops it
Termination claims the cell before awaiting its outcome, so a lost IPC response makes the retry return already terminating or missing instead of the original terminal output

[jif-oai]

This task keeps the runtime alive even after the service and all replay receivers are gone, so dropping the session no longer cancels the cell until the observation deadline finishes
This is a standard ownership deadlock. This needs a proper teardown or a weaken hold