code-mode: move session ownership into runtime (#29285)

## Summary

- Move code-mode cell ownership and shared stored values from
`CodeModeService` into `SessionRuntime`.
- Keep the protocol-facing execute/wait behavior behind the existing
service adapter.
- Add runtime-level ownership and isolation coverage.

## Why

This establishes a transport-neutral session boundary before later
lifecycle and create/observe changes.

## Impact

No intended model-facing behavior change. This is an ownership and
layering refactor.

## Validation

- Stack-tip validation: `just test -p codex-code-mode -p
codex-code-mode-protocol` (70 passed).
- Parent branch: `cconger/code-mode-runtime-compact-03a-runtime-types`.

codex-rs/code-mode/src/service_contract_tests.rs

@@ -288,8 +288,20 @@ async fn observed_natural_completion_wins_over_termination() {
     );
     tokio::time::timeout(Duration::from_secs(1), async {
         loop {
-            if service.inner.stored_values.lock().await.get("finished")
-                == Some(&serde_json::json!(true))
+            let response = service
+                .execute(execute_request(r#"text(String(load("finished")));"#))
+                .await
+                .unwrap()
+                .initial_response()
+                .await
+                .unwrap();
+            let RuntimeResponse::Result { content_items, .. } = response else {
+                panic!("expected stored-value probe to complete");
+            };
+            if content_items
+                == vec![FunctionCallOutputContentItem::InputText {
+                    text: "true".to_string(),
+                }]
             {
                 break;
             }