feat(engine): wire cli-agent executor seam and task session lifecycle (U7)

Add `cli-agent` as a task-execute executor kind. A workflow node with
`config.executor === "cli-agent"` drives an engine-owned CLI coding agent
through the execute step via the new cli-agent/task-session.ts orchestration:
spawn in the worktree, issue the hook token + write hook scripts, inject the
prompt after readiness, subscribe to the state machine, and resolve on a
positive completion signal (R20 gating). Config is snapshotted at launch; the
PTY is reaped (completed) at the in-review handoff.

Executor seam: runGraphCustomNode gains a cli-agent branch delegating to
runCliAgentNode; the hard-cancel/abort path (awaitAbortInFlightTaskWork +
abortAllInFlight) claims and SIGKILLs the CLI session as a first-class surface,
marking it killed (never resume-eligible). Re-entry kills any prior live
session and launches fresh; follow-up resumes the recorded native session id
when supported. A PTY-pool ceiling surfaces as a typed task value, not a stall.

Node-config typing extended minimally (WorkflowNodeExecutorKind /
WorkflowNodeExecutorConfig in @fusion/core).

Tests: cli-agent/__tests__/task-session.test.ts (12) and
__tests__/cli-agent-executor.test.ts (9) cover AE1/AE5, hard cancel, re-entry,
follow-up, config snapshot, ceiling, and the generic-tier confirm-advance path,
using scripted adapters + a mock PTY seam. Engine typecheck clean; full
src/cli-agent suite + new tests green (144 passing).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/engine/src/index.ts

@@ -646,3 +646,33 @@ export {
   type WriteSessionHookScriptsOptions,
   type WrittenHookScripts,
 } from "./cli-agent/hook-scripts.js";
+// CLI Agent Executor — PTY session manager + adapter registry (U2).
+export {
+  CliSessionManager,
+  CliConcurrencyLimitError,
+  UnknownCliSessionError,
+  neutralizeInjection,
+  DEFAULT_SCROLLBACK_BYTES,
+  DEFAULT_CONCURRENCY_CEILING,
+  type CliSessionManagerOptions,
+  type SpawnCliSessionOptions,
+  type CliSessionAttachment,
+} from "./cli-agent/session-manager.js";
+export {
+  CliAdapterRegistry,
+  defaultCliAdapterRegistry,
+  UnknownCliAdapterError,
+  DuplicateCliAdapterError,
+  type CliAgentAdapter,
+  type CliAdapterCapabilities,
+} from "./cli-agent/adapter.js";
+// CLI Agent Executor — task ↔ session orchestration (U7).
+export {
+  CliTaskSession,
+  launchCliTaskSession,
+  killLiveTaskSessions,
+  type CliTaskOutcome,
+  type CliTaskOutcomeKind,
+  type ResolvedCliExecutorConfig,
+  type LaunchCliTaskSessionOptions,
+} from "./cli-agent/task-session.js";