code-mode: define transport-neutral runtime types (#29170)

## Summary

- introduce a private `session_runtime` boundary for cell creation
requests, observation modes, lifecycle events, output items, and tool
metadata
- update the cell actor and in-process service to use those
transport-neutral types
- keep cell ID allocation on the owning session side

## Motivation

Cell lifecycle vocabulary currently lives inside the cell actor
implementation. That makes the service adapter and future session
runtime depend on actor-specific types, increasing the size and
complexity of the runtime ownership change.

This is the first reviewable slice of the session-runtime stack. It
separates the transport-neutral data model without moving lifecycle
ownership or changing behavior.

Later slices will move session state behind this boundary, harden
terminal and shutdown behavior, and split cell creation from
observation.

## Behavior

There are no public API or user-visible behavior changes in this PR.

In particular:

- `CodeModeSession::execute` and `wait` are unchanged
- cell IDs remain allocated by the owning session
- cell admission, observation, termination, and shutdown behavior are
unchanged

codex-rs/code-mode/src/cell_actor/tests.rs

@@ -11,6 +11,7 @@ use tokio::sync::oneshot;
 use tokio_util::sync::CancellationToken;
 
 use super::*;
+use crate::session_runtime::OutputItem as CellOutputItem;
 
 struct TestHost;