test: characterize replay application behavior and coordinator ownership

[thymikee]

Summary

Adds one representative application-boundary contract through handleSessionReplayCommands for native and Maestro replay/test flows. It covers admission-before-mutation, routing, session lifetime, failure projection and artifacts, format-neutral suite hosting, progress, and cancellation. The existing AST/import coordinator-ownership proof remains unchanged; no production files or exports changed.

Closes #2130

Validation

• Focused replay and ownership run: 8 files, 84 tests passed.
• pnpm check:affected --run: all runnable checks passed (format, lint, typecheck, fallow, related Vitest).
• Temporary planted-red behavior probes, all restored: session lifetime, exact failure message, failed-step artifact ledger, target admission before dispatch, Maestro routing, progress emission, and active cancellation each failed its named application test when violated.
• Temporary planted-red structural probes, all restored: a second createReplayCoordinator import failed both ownership tests; a SessionStore import in the resume chain failed the named no-binding test.
• Independent adversarial review found no valid findings; no changes were needed.

Scope / size

• Touched files: 1.
• Production files and exports changed: 0.
• Gross diff: +296 / -0 lines.
• Net test LOC: +296. Existing routing/runtime tests either bypass this handler seam or cover distinct contracts, so no identical coverage was removed.

Residual risks

• The focused contract uses real session/source fixtures and mocks only the device snapshot boundary; native/device/provider/live-network behavior and exact-head GitHub lanes remain CI responsibilities.
• Coordinator identity remains intentionally covered by the separate AST/import proof because behavior tests cannot distinguish two coordinators backed by the same store and session.

[github-actions]

Size Report

Metric	Base	Current	Diff
JS raw	2.51 MB	2.51 MB	0 B
JS gzip	841.4 kB	841.4 kB	0 B
npm tarball	968.2 kB	968.2 kB	0 B
npm unpacked	3.35 MB	3.35 MB	0 B

npm unpacked components

Component	Base	Current	Diff
JS / dist source	2.67 MB	2.67 MB	0 B
Apple runner source/project	581.1 kB	581.1 kB	0 B
macOS helper source	54.8 kB	54.8 kB	0 B
Android helper artifacts	0 B	0 B	0 B
Other package files	45.6 kB	45.6 kB	0 B

Startup median (7 runs, lower is better):

Scenario	Base	Current	Diff
CLI --version	27.2 ms	26.6 ms	-0.6 ms
CLI --help	73.2 ms	73.9 ms	+0.6 ms

Top changed chunks: no changes in the largest emitted chunks.

Top changed packed files

No changed packed files.

[thymikee]

Review found no code or characterization-design issues. The new suite asserts application behavior at handleSessionReplayCommands without pinning engine decomposition, while the existing AST/import gate remains the correct separate proof of single coordinator ownership. The 296 test LOC cover the issue's distinct admission, routing, failure/artifact, lifetime, format-neutral suite, progress, and cancellation rows; no production surface changed. Remaining status is CI only: Android Smoke and Coverage were still running at review time.