Persist completed session results

[areshand]

Summary

• require external-only completion to bind a bounded, self-contained caller result artifact under the session state root
• make trace reports prefer that explicit result over the procedural provider tail
• keep successful session workers available for a bounded completion grace period
• authenticate the gateway to the worker, cache the bounded final report on gateway storage, and serve it after the Job exits
• keep routing and report persistence provider- and operation-neutral

Production findings

Session github-pr-e2e-0826d completed its external-only workflow with two independently reviewed successful github.read receipts and correctly selected aptos-core PR #20446. The E2E still could not pass because the completion command terminated the model before a self-contained caller response was persisted, and the gateway report endpoint depended on a live worker Pod. The exported trace contains the correct operational evidence but the generated report contains only status and trace links.

Architecture

The control server continues to own result streaming and persistence. The orchestrator only synthesizes the caller response from the original goal and accumulated role results; it gains no operation-specific knowledge or transport credentials. Normal source completion is unchanged.

Validation

• rustup run 1.98.0 cargo fmt --check
• rustup run 1.98.0 cargo test --workspace --all-targets (59 passed)
• rustup run 1.98.0 cargo build
• npm test --prefix control-server (10 passed)
• tests/run.sh
• tests/mock_orchestration_e2e.sh
• git diff --check