feat(ai): session harness contract — incomplete, run_id, confirm bind

Add docs/16 for session state machine, incomplete/resume, queue semantics,
and agent-loop/harness/MCP gap review. Wire RunOutcome on max-rounds,
run_id through audit, TrimMessages/Redact hooks, ConfirmBindHash on write
confirm path; session file skeleton without HTTP yet. No push.

src/api.ts

@@ -540,6 +540,12 @@ export type AiAgentRes = {
   sql?: string;
   steps: AiAgentStep[];
   rounds: number;
+  runId?: string;
+  sessionId?: string;
+  runOutcome?: string;
+  incompleteReason?: string;
+  resumable?: boolean;
+  stepsBudget?: number;
 };
 
 export async function callAiAgent(payload: {
@@ -564,6 +570,7 @@ export type AiAgentStepExt = AiAgentStep & {
   pending?: boolean;
   needConfirm?: boolean;
   confirmSql?: string;
+  confirmBind?: string;
   result?: AiAgentQueryResult;
 };
 
@@ -691,6 +698,8 @@ export async function confirmAiAgentWrite(payload: {
   command?: string;
   database?: string;
   kind?: "query" | "redis";
+  confirmBind?: string;
+  runId?: string;
 }) {
   return post<Record<string, unknown>>("/api/ai/agent/confirm", payload);
 }