fix(caprock): accept lastActiveAt in KernelSessionStruct

The daemon's `session.create` and `session.list` responses include
`lastActiveAt` (added to power the TUI's recency buckets), but the strict
`KernelSessionStruct` did not declare it, so `assert(result, KernelSessionStruct)`
in `createKernelSession` rejected every response. That failure propagated out of
the SessionStart and PreToolUse hooks, which then produced no decision — Claude
Code fell back to its native permission prompt and nothing routed through the
TUI. Declare `lastActiveAt` as an optional field to match the response.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: grypez

packages/caprock/src/structs.ts

@@ -70,6 +70,7 @@ export const KernelSessionStruct = object({
   ocapUrl: string(),
   cwd: optional(string()),
   startedAt: optional(string()),
+  lastActiveAt: optional(string()),
 });
 
 export const LaunchSubclusterStruct = object({