Per-session actor: the single writer for one session. Holds the writer
lease, keeps the in-memory current revision, tracks the active run, and
owns the broadcast feed for the session.
Default decision chain (SPEC §8.3 决策优先级): 硬拒绝 → grants → session →
product → default. v0.1 delivers the combinator plus the grant layer; the
session layer is an empty placeholder (documented plan simplification) and
the product/default layers are closures the host supplies as ordinary
Policy implementations stacked into the chain.
AgentRuntime: the host-facing facade over per-session actors (SPEC §3.2,
§12). Each session has at most one actor task holding the writer lease,
which serializes all authoritative writes for that session.