Add durable threads across execution sessions

[areshand]

Summary

• add owner-scoped threads containing public events, execution sessions, checkpoints, and artifact/trace references
• start one fresh isolated Kubernetes Job and fresh agent tree for every execution session
• resume a thread with bounded public history and session-scoped trace references instead of reviving previous agents or provider-native sessions
• persist the compact thread manifest through a file-backed store on the deployment-owned gateway volume
• use session-bound internal worker tokens while keeping browser credentials at the gateway
• add a two-session GitHub thread-resume E2E harness
• attach thread/session/lease/authorizing-event attribution to new prod-mcp permits

Persistence model

Detailed agent and model histories remain in the existing S3 trace export. The control server stores only the compact public thread manifest required to route and resume work. This PR removes the earlier DynamoDB implementation and AWS SDK dependencies.

Automatic restoration from S3 is intentionally excluded while gateway and execution-session Pods share the same S3 IAM identity. S3 remains backup and audit storage; normal gateway restarts recover the manifest from the persistent volume.

Validation

• npm test in control-server: 17 passed
• cargo test: 59 passed
• all GitHub CI checks pass on Linux, macOS, Python 3.8, and Python 3.13

Deployment dependency

Merge after prod-mcp #12 and deploy with InternalServices #56, which mounts the existing gateway state volume and injects thread/session attribution into execution Jobs.