[gurnben]

Summary

crush runs went through crush run, whose quiet stdout made the monitor look frozen for minutes and reported no token usage — so budget bands and spend declarations never had data, and aborts were process kills. This PR drives crush through crush server with our UI as the client:

• New SessionRunner harness interface: the runner prefers a managed session backend over the one-shot process, sharing the same event pipeline (journal, sink, budget bands, needs-input detection), and falls back to the process path when the backend cannot start.
• crush serve client: spawns crush server on a private Unix socket, creates a workspace + session, holds the SSE stream open (that attachment is what keeps the workspace alive — discovered from crush's backend lifecycle), and drives the prompt with a RunID.
• Live events: tool calls with arguments, finished thinking blocks, assistant text, and cumulative token usage from session updates — all mapped to normalized events. run_complete (RunID-correlated; foreign runs ignored) terminates the turn with its final text or error.
• Real budget + spend: usage events feed the budget bar and the registry models spend row — previously impossible with crush run.
• Clean aborts: ctrl+c / budget refuse / needs-input now cancel the remote session via the cancel endpoint before the server is torn down.
• Fail-closed permissions: permission and question requests cannot be answered unattended; the run exits 2 naming the tool, with a note pointing at pre-allowing tools in a .crush/crushrc at the harness root.
• Model override: POST /config/model (scope 1, model_type large) with the provider resolved from the crush models listing — model ids contain slashes, so the provider is taken from the listing line, not by splitting.

Verification

• API surface verified live against a real crush server (v0.96.1): workspace/session creation, SSE envelope and part shapes, token-bearing session updates, RunID echo on run_complete.
• 8 new tests against an in-process fake speaking the same v1 API: happy path (tool/thinking/text/usage events, result text), permission fail-closed with remote cancel, run_complete errors, foreign-run filtering, model override request shape, and runner-level integration (events to sink, usage-driven spend row, exit codes 0/1/2).
• Live end-to-end smoke through the real binary: server spawned and reaped, tool calls and usage streamed, a permission request correctly failed closed with exit 2, journal complete, no orphaned processes.
• Full suite with race detector, vet, staticcheck clean (48 tests).

💘 Generated with Crush