hive-runtime: cancel and idle watchdog for ACP turns

`Runtime` gets a fourth operation, `canceller()`: a handle that stops the
turn in flight from outside `run`. The ACP backend returns one; claude
returns `None`, because the harness stops a claude turn by signalling the
`claude` process, and that path is unchanged.

Both stops send the agent `session/cancel`:

- `Canceller::cancel()`, when asked from outside. The turn then ends
  normally, reported with stop reason `cancelled` whatever reason the agent
  gives. opencode 1.15.10, for one, answers a cancelled prompt with
  `end_turn` (`acp/agent.ts` `prompt()` always returns `end_turn`).
- The idle watchdog, once no `session/update` has arrived for
  `Config::idle_timeout`, the same field claude's watchdog reads. The turn
  fails with `AcpError::IdleTimeout`.

An agent that has not answered the prompt 10s after `session/cancel` is
killed (`IdleKilled` / `CancelIgnored`), and the next turn respawns it.

The watchdog is also what ends a turn stuck on a provider HTTP 429.
opencode 1.15.10 retries a retryable provider error with no attempt limit
(`session/retry.ts` `policy`, `session/processor.ts` `Effect.retry`) and
forwards neither `session.status` nor `session.error` over ACP (its
`handleEvent` only handles `permission.asked` and `message.part.*`). So the
ACP client sees nothing at all until the provider recovers. The
`IdleTimeout` message says a silently retried provider error looks like
this.

Refs #4391

hive-runtime/src/acp/rpc.rs

@@ -135,6 +135,12 @@ impl Connection {
         Ok(rx)
     }
 
+    /// Send a notification: a message the agent does not reply to.
+    pub(super) async fn notify(&self, method: &'static str, params: Value) -> Result<(), AcpError> {
+        let message = json!({ "jsonrpc": "2.0", "method": method, "params": params });
+        write(&self.stdin, &message).await
+    }
+
     /// Send a request and wait for its reply, queueing anything else the agent
     /// sends meanwhile on [`Self::incoming`].
     pub(super) async fn request(