Move session preparation into workflows and unify resource attachments

[lukebuehler]

Session creation, profile/config application, and runtime context refresh now run through the session workflow. Preparation publishes validated changes atomically, retains operation receipts for retries, and reconciles toolsets at safe turn boundaries.

The configuration now uses resource attachments consistently:

• Workspaces and environments carry access grants per attachment. Environments also carry a working directory and optional default; sub-agent profiles can inherit the parent’s active environment.
• MCP attachments may narrow the server’s allowed tools. Server and session editors share discovery and tool selection, with descriptions always visible. MCP starts empty and attachments must be removed before disabling it.
• Session creation uses the effective config’s default environment attachment. The separate creation override is removed from the UI, web gateway, ordinary and managed session APIs, and generated consumers.

Environment provisioning, credentials, power, and cleanup remain independently managed. Session closure and deletion preserve environments. The gateway, runtime adapters, CLI, demo, schemas, TypeScript clients, Configurator MCP, and documentation follow the new boundaries and attachment names.

Deployment requires matching runtime and clients, fresh session workflow histories, schema migration 10, and conversion of saved profiles to the new attachment shapes. Retain existing session records for historical reads and preserve environment resources; migration 10 does not rewrite profile documents.

Validation:

• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets --locked -- -D warnings
• cargo test --workspace --locked
• CI’s embedded migration ledger test, serialized against an isolated local schema
• npm run check:ci, including platform migration and release packaging checks
• npm run check:docs and release metadata validation

The CI fixes correct module ordering, box the large prepared-run admission payload, and resolve the remaining Clippy warnings without suppressing lints. Provider-request fixtures now reflect attachment descriptions and the environment list tool’s empty argument schema.