fix(agent-loop): second review pass — late-steering discard, dead-branch, catalog leaks

Address a second fresh-eye review of the review fixes:
- MAJOR: late steering that lands after runTurn returns terminally
  stopped (e.g. during the post-turn flush) was drained by runLoop and
  dropped without a discard, leaving a dangling outstanding id the
  negative-only invariant can't catch. Emit agent/inbox/discard for it,
  symmetric with the in-turn terminal-stop drop.
- remove the dead cancel() idle-settle branch: whenIdle's fast path
  already resolves for a lone quiet item, so no waiter is ever left for
  it to settle. Document why.
- gen-cordis-api classShape now drops private/protected/#private members
  and strips getter/setter bodies, so Session no longer leaks private
  fields and getter bodies into the model catalog.
- document that AgentMessage intentionally omits meta (durable-only).

Adds a regression test for the late-steering discard.

docs/core-data-structures/core.md

@@ -428,7 +428,9 @@ The `agent/inbox/*` live events carry one accepted message; injection bypasses t
  * message's enqueue, dequeue, and discard events. Source defaults are already
  * applied, so these are the exact values the item was accepted with. `steering`
  * is true for a `next-step` item drained between steps; a `next-turn` item is
- * claimed at a turn boundary.
+ * claimed at a turn boundary. `SendOptions.meta` is intentionally omitted: it is
+ * durable model-hidden state that lands on the eventual `user/message`/
+ * `steering/message`, not live-event routing data.
  */
 interface AgentMessage {
   /** The id `send` returned for this message. */