feat(acp): add v1 session/load and session/resume restore builders

[changshenhan]

Closes #323

What

Stable-v1 direct clients can now turn session/load and session/resume into an ActiveSession. ConnectionTo<Agent> gains three entry points:

• ConnectionTo::load_session(session_id, cwd) — sends session/load
• ConnectionTo::resume_session(session_id, cwd) — sends session/resume
• ConnectionTo::restore_session_from(request) — forwards an intercepted restore request (e.g. one decoded from a client) unchanged

Both blocking (block_task().start_session()) and non-blocking (on_session_start(…)) forms are provided, mirroring SessionBuilder.

Because v1 restore responses carry no session id, the response type is reduced to modes()/meta() for the ActiveSession, while the complete response stays available in the returned RestoredSession { session, response } (mirroring the v2 OpenedV2Session shape). The session id is taken from the request. This works with stable protocol v1 only — no proxy or unstable MCP features required.

Two properties the tests pin

1. Routing is installed before the request is published. prepare_session_routing registers the ActiveSessionHandler before send_ordered_request_to/send_request_to, so replay or early notifications for the restored session are captured even when they precede the restore response in dispatch order. load_session_routes_early_notification_and_returns_exact_response sends the update before the response in the same batch and asserts it is routed.

2. Failed restores drop routing. On an error response the DynamicHandlerGuard is dropped, so a later update for the failed session id cannot reach a stale handler. failed_restore_returns_err_and_drops_routing errors the first restore, sends a late update for the failed id, and then succeeds on a second restore over the same connection.

restore_session_from_forwards_an_intercepted_request verifies the interception path forwards the request verbatim, and resume_session_round_trips_exact_response covers the blocking path.

Verification

• session_restore suite passes under --all-features and under default features (4/4 each) — confirming the operation needs no unstable/proxy features.
• cargo clippy -D warnings and cargo fmt are clean on native.
• Full cargo test --all --workspace --all-features passes every test binary except arrow_proxy_eliza, which fails only on a pre-existing Windows harness issue (see note).

Note for Windows contributors

agent-client-protocol-test::test_binaries::require_binary asserts path.exists() on the extensionless path (target/debug/examples/arrow_proxy). On Windows the built binary is arrow_proxy.exe, so Path::exists() is always false there and just test cannot complete. Not touched by this change, but a #[cfg(windows)] .exe suffix would unblock Windows contributors — happy to send that as a follow-up if useful.

CHANGELOG

Added entry in src/agent-client-protocol/CHANGELOG.md.