feat: handoff drain policy for session lifecycle

[rileywhite]

Before you continue

• I searched existing issues and did not find a duplicate.
• I can explain the user problem this solves, not just the implementation I prefer.

Problem to solve

With defer_until_idle (from #504 / PR #654), the reconciler can delay draining an active session — but when the grace timeout expires, it still force-drains. For sessions where context continuity matters (crew-owner sessions with a human attached, long-running coordination agents like mayor), a forced drain loses accumulated context that is expensive or impossible to reconstruct.

There is currently no way to tell the reconciler "drain this session, but preserve its context first."

Proposed change

Add a third drain_policy value: handoff.

[agent.lifecycle]
drain_policy = "handoff"
grace_timeout = "5m"

When the reconciler decides to drain a session with drain_policy = "handoff":

1. Trigger gc handoff on the session instead of a bare drain+stop
2. The session dumps its context (conversation state, in-progress work references) before terminating
3. On restart, the new session can recover from the handoff artifact

This extends the guard-clause pattern established by immediate and defer_until_idle but requires new plumbing: the reconciler must orchestrate a handoff before proceeding with the drain, rather than simply skipping or proceeding.

Alternatives considered

• defer_until_idle with long grace timeout: Delays the problem but doesn't solve it — eventually the timeout fires and context is lost anyway.
• PostToolUse hook checking env var (from config-drift can drain active named sessions without graceful handoff #119): Couples hook system to reconciler internals, fires only after tool completion, fails silently if hooks aren't configured.
• Prompt injection signaling imminent drain: Wastes context every turn for a rare event, requires session cooperation.

Scope and impact

• Reconciler: Third branch in the config-drift and idle-timeout drain guards (alongside immediate and defer_until_idle). Calls gc handoff instead of proceeding directly to drain.
• Config schema: New enum value handoff for drain_policy. Additive — no migration.
• Dependencies: Requires the [agent.lifecycle] infrastructure from PR fix: reject named_session entries referencing pool agents (#574) #654 (feat: per-agent drain policy in session templates #504). This issue only makes sense if that direction lands.
• gc handoff integration: The handoff command already exists; this wires it into the reconciler's drain path.

Blocked by: #504 (PR #654)