feat(agent-loop): turn-enclosure invariant + post-turn error model

Every session event now lives inside a turn (between turn/start and its
turn/end). The loop records queued user/message events AFTER turn/start;
an idle agent.inject() wraps its context/message in a one-shot injection
turn. This makes the turn the single durability/replay boundary so a
persistence backend can treat anything after the last turn/end as a
crash tail without dropping legitimate between-turn context.

A failure once the turn is already closed (rejecting session/flush, a
throwing agent/turn-end listener) has no in-turn position for a session
error event, so it is reported via agent/error + logger only; the turn
stays balanced. failTurn appends an error event only while the turn is
open.

The dsh-invariants plugin enforces turn-enclosure via a default case:
every non-boundary event type — including plugin-added merge-extensible
keys — must sit inside an open turn or it throws.

Documented in ADR 0017 + architecture.md.

packages/agent-loop/README.md

@@ -41,7 +41,7 @@ One invocation of `runLoop()` drives one agent for its whole lifetime:
 forever:
   wait for queued messages (idle)
   TURN (error-contained):
-    drain queued → session('user/message') → 'turn/start'
+    drain queued → 'turn/start' → session('user/message')
     STEP loop:
       drain steering
       assembly = systemPrompt.assemble()