hive-runtime: cancel and idle watchdog for ACP turns

`Runtime` gets a fourth operation, `canceller()`: a handle that stops the
turn in flight from outside `run`. The ACP backend returns one; claude
returns `None`, because the harness stops a claude turn by signalling the
`claude` process, and that path is unchanged.

Both stops send the agent `session/cancel`:

- `Canceller::cancel()`, when asked from outside. The turn then ends
  normally, reported with stop reason `cancelled` whatever reason the agent
  gives. opencode 1.15.10, for one, answers a cancelled prompt with
  `end_turn` (`acp/agent.ts` `prompt()` always returns `end_turn`).
- The idle watchdog, once no `session/update` has arrived for
  `Config::idle_timeout`, the same field claude's watchdog reads. The turn
  fails with `AcpError::IdleTimeout`.

An agent that has not answered the prompt 10s after `session/cancel` is
killed (`IdleKilled` / `CancelIgnored`), and the next turn respawns it.

The watchdog is also what ends a turn stuck on a provider HTTP 429.
opencode 1.15.10 retries a retryable provider error with no attempt limit
(`session/retry.ts` `policy`, `session/processor.ts` `Effect.retry`) and
forwards neither `session.status` nor `session.error` over ACP (its
`handleEvent` only handles `permission.asked` and `message.part.*`). So the
ACP client sees nothing at all until the provider recovers. The
`IdleTimeout` message says a silently retried provider error looks like
this.

Refs #4391

CLAUDE.md

@@ -53,7 +53,7 @@ hand-maintained per-file tree drifts out of sync with the code.
   launch-config layer (tool-group/capability → `--allowedTools`,
   `--mcp-config` render).
 - **`hive-runtime/`** — the runtime an agent's turns run on: one
-  `Runtime` interface (`run`/`compact`/`archive`) with a `claude` backend
+  `Runtime` interface (`run`/`compact`/`archive`/`canceller`) with a `claude` backend
   (a pass-through to `hive-claude`) and an `acp` backend (any Agent Client
   Protocol agent, spawned from the command/args/env nix hands it — no agent
   is named in Rust). The ACP backend translates its stream into claude's