refactor: make application session state the sole write authority (M6.5.4)

[KeyffMS]

Implements M6.5.4 from #26: remove mutable session-policy ownership from the production write runtime while preserving fail-closed write/restore behavior.

Scope:

• RuntimeSessionControl now stores an application-owned WriteSessionSnapshot projection whose only writer is sync/WriteEffect::SyncSession;
• begin/finish/disarm/audit-failure paths no longer mutate cached authorization/audit/operation fields;
• runtime keeps only a restrictive execution fence for in-flight single-write/restore sequencing and stale-projection protection;
• the execution fence can only remove capabilities (operation_idle=false, armed=false, audit_healthy=false) while waiting for authoritative application sync; it never grants a capability;
• restore operation_id / plan_hash / next_index remain runtime execution sequencing data, not session-policy state;
• tests prove cached projection changes only through explicit sync, restore sequencing does not own session state, and disarm/audit barriers remain fail-closed until authoritative sync;
• architecture gate enforces exactly one production projection writer and rejects mutable projection guards.

No transport, profile, audit-storage, TUI or physical-write authority is added. WriteCoordinator remains the only physical write authority; SessionStateMachine remains the application authority for authorization/audit/operation decisions.

Refs #25
Refs #26