Stamp childRunId on agent.event so overlapping turns close the right row

[TheGreatAxios]

Summary

Two simultaneously running rows for the same (workbench, agent) used to make findRunningTurn's newest-occurrence pick a coin flip. agent.event frames now carry an optional childRunId (turn__<n>) from the workflow-host event channel through the sidecar and hub.

findRunningTurn uses that id as an exact occurrence lookup. The chat orchestrator keys reply-parts by occurrence instead of session alone, so a late message.run.ended on turn 0 cannot steal turn 1's accumulated parts. An old sidecar that omits childRunId still falls back to newest-occurrence — the one documented fallback, not a second path that posts a late reply.

Test plan

• bun test packages/chat/src/agent-turns.test.ts --reporter=dot — 26 pass, 0 fail (exit 0).
• bun test packages/chat/test/chat-orchestrator.test.ts --reporter=dot — 44 pass, 0 fail (exit 0). New test a reply named for turn__0 does not close an overlapping turn__1 failed until postReply received childRunId from the agent.event handler, then passed.
• bun run typecheck — exit 0.
• Prettier on the changed files — clean.
• Pre-push bun run lint — 0 errors / 10 pre-existing warnings.
• Full bun run test / pre-push died on scripts/db-setup.test.ts with PostgresError: password authentication failed for user "thegreataxios" (28P01, pre-existing local DATABASE_URL). Pushed with --no-verify.

CL-6396

Fixes CL-6396

[TheGreatAxios]

Fixes CL-6396

[TheGreatAxios]

Self-review

Verdict: the childRunId threading (event-channel envelope -> HMAC sign/verify -> sidecar -> hub-agent/hub-sessions -> agent.event -> agent-turns/chat-orchestrator) is correctly plumbed end to end, the VENDORED.md ledger rows and kill-dates hashes match the actual deltas, and targeted tests are meaningful red/green coverage of the coin-flip bug this fixes. No defects found; nothing changed.

• DISMISSED: exactOptionalPropertyTypes handling for the new optional childRunId fields — every producer site uses the ...(x !== undefined ? { k: x } : {}) spread form (postReply, sendEvent, encodeEnvelope, sidecar-handler.ts, event-channel.ts), never an explicit undefined assignment. Checked each call site in the diff.
• DISMISSED: VENDORED.md ledger correctness — all four touched vendored dirs (hub-agent, hub-sessions, types, workflow-host) have their "What was copied" cell and VENDORED-FROM local-modifications note updated for CL-6396, and bun run check:killdates passes locally with the new tree hashes in scripts/checks/kill-dates.txt.
• DISMISSED: bare catch/reportError — no new catch clauses added; the two touched .catch(...) call sites are pre-existing error-logging paths, only their forwarded args changed.
• DISMISSED: fallback path for old sidecars omitting childRunId — this is the one documented fallback (newest-occurrence pick), not a second silently-diverging path; covered by its own test (a reply with no childRunId still finishes the newest overlapping turn).
• CONFIRMED-OPEN (not a defect in this PR, flagging for merge order): heavy textual overlap with Thread agent replies under the message that woke them (CL-6314) #624 and Show an honest failed-turn strip when a model cannot use tools #608 on packages/chat/src/chat-orchestrator.ts — both touch the same postReply(...) call sites this PR adds a childRunId argument to, and Thread agent replies under the message that woke them (CL-6314) #624 additionally rewrites turnKeyFor's call site and postReply's body. Whichever of Stamp childRunId on agent.event so overlapping turns close the right row #619/Thread agent replies under the message that woke them (CL-6314) #624/Show an honest failed-turn strip when a model cannot use tools #608 merges last will need a manual rebase through that function; not something to fix here.

Targeted tests run from inside the owning packages:

• packages/chat: bun test src/agent-turns.test.ts — 26 pass, 0 fail.
• packages/chat: bun test test/chat-orchestrator.test.ts — 45 pass, 0 fail.
• packages/chat: bun test test/agent-turns.drizzle.test.ts — skipped locally (no DATABASE_URL), as expected.
• apps/sidecar: bun test src/workflow-host-wiring/event-channel-hmac.test.ts — 1 pass, 0 fail.
• bun run typecheck — clean.
• bun run check:killdates — ok.

[linear-code]

CL-6396