[SaladDay]

Item, Subagent and Artifact reads, and Artifact staging, move out of store into sessions and sessionpg. This PR also introduces the public Session skeleton that the remaining Session PRs extend.

What changes

• sessions skeleton:
  • Service{storage Storage} with NewService.
  • Storage, which embeds ArtifactStorage.
  • Reader, which embeds ArtifactReader, ItemReader and SubagentReader.
• sessionpg:
  • Store{units} with New(units).
  • It implements the Artifact, Item and Subagent reads and the staging transaction.
  • LoadPublicSubagent and LoadChildTurn are shared participants.
• Artifact staging:
  • sessions.Service.StageTurnArtifacts is a pooled use case.
  • Inside one transaction it runs these steps in order:
    1. Authorize the Environment.
    2. Stream the export into large objects.
    3. Take the Session lock and recheck that the Turn is still running.
    4. Record the private Artifacts.
  • CompleteExecution stays the only fence that publishes or discards them.
  • The staging rules (the export shape and the running-Turn recheck) are tested against strict fakes.
• execution.Dispatcher gains the required fields Sessions and SessionsReader, and StartWorker validates both.
• api:
  • The Items, Subagents and Artifacts handlers read through sessionpg.Store and delete through sessions.Service.
  • These handlers map errors with writeSessionsError.
• Removed from store: item_reads.go, session_artifacts.go, artifact_capture.go, subagent_reads.go, subagent_item_reads.go and list_cursors.go.
• IMPLEMENTATION.md names the new owners.

Behavior

Public behavior is unchanged: pagination, ordering, visibility, the cursor errors and the export shape. There are small internal differences:

• A missing Turn during staging is ErrNotFound instead of a raw driver error.
• A stored Environment type that cannot be read is rejected as invalid input.
• The Environment is loaded inside the staging transaction.

Checks

• go build ./... and go vet ./services/core/....
• sessions and sessionpg in full.
• api Artifact, Item and Subagent tests, plus every test in the changed api test files.
• execution -run 'StartWorker|Artifact|WorkerRun|Owner'.
• cmd/server in full, and providers -run Configuration.
• Store: exact-name runs of the 71 tests in the 31 changed test files. The official-client and native-daemon cases ran with the pinned SDK and a daemon built from this head.
• make openapi produces no diff.
• scripts/check-names.py.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}