[SaladDay]

Several Session operations repeat the same multi-step sequences: cancelling a Turn, failing or terminating an Environment, and bracketing input activity. This change writes each sequence once, as a procedure in sessions, over a minimal transaction interface. The PostgreSQL side implements those interfaces in sessionpg as named participants, so later PRs can compose them inside their own transactions. For example, deployment's allocation cleanup can run Environment termination in its own transaction.

What changes

• sessions procedures and rules:
  • CancelTurn, CancelWork and DecideCancellation.
  • FailEnvironment, TerminateEnvironment and the termination decision.
  • TrackInputActivity.
  • CreateEnvironmentDevice: load, then the binding rule, then an insert-only apply.
  • The admission checks CheckComputeAdmission, CheckFileWriteGate and CheckInputStart.
  • The locked-Session types JournalTx and ActiveTurnTx.
• sessionpg:
  • LockSession and WithSession are the single transaction shape for a locked Session.
  • BindSession(q, tenant, session) returns a SessionTx that implements the procedure interfaces on a transaction-bound *sqlc.Queries.
  • Environment and row helpers.
• pgunit.Transactor replaces store's private transactor.
• Store callers now use the procedures instead of their own copies.
• Scoping: Environment writes through a binding are scoped to the binding's Session and tenant. RecordEnvironmentFailure and ExpireSessionEnvironment check both.
• Docs: IMPLEMENTATION.md lists the permitted participants (LockSession, BindSession) and the import direction.

Behavior

Unchanged, except for one case. Expiring or settling an Environment now normalizes its stored configuration through EnvironmentFromRow, as failed initialization already did. This affects only corrupt stored data.

Checks

• go build ./... and go vet ./services/core/....
• sessions and sessionpg in full, including:
  • a PostgreSQL test showing that two transactions exclude each other on the Session lock;
  • tests that a binding cannot write another tenant's or another Session's Environment.
• A focused store -run subset: devices, runtime allocation, Environment termination and failure, initialization failure detail, file writes, runtime nodes, archive, deletion and cancellation.
• scripts/check-names.py.

A blind review found no blockers or majors. Its minor findings are fixed in this commit.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}