feat(commandbridge): harden native session recovery

[chicoxyzzy]

Problem

Command-backed adapters can prove that a provider-native conversation backing an adopted ACP session no longer exists, but the shared bridge currently collapses that condition into an unclassified prompt failure. Hosts cannot distinguish safe first-turn recovery from an established conversation whose history was deleted or expired.

The bridge also generated default session IDs from a process-local counter, so a restarted process could reuse the same ID and make host-side replacement impossible to commit safely.

Contract

• add an optional provider-owned prompt-failure classifier to commandbridge.Spec
• invoke it only for a real nonzero process exit and preserve the existing RPC code/message while adding native_session_missing
• give the classifier the ACP session, exact process spec, bounded result, and error
• keep retry and session mutation out of the kit so the host decides from persisted conversation state
• generate default new/fork session IDs from 128 bits of secure entropy so IDs remain distinct across process restarts
• fail session creation/fork before state mutation when entropy or a custom ID generator yields no usable ID

Safety coverage

• classifier is not called for launch/parser errors or a zero exit code
• classified failure performs one command attempt, does not increment prompt history, and leaves the original session usable
• independent bridge instances produce distinct new and fork IDs
• a fork cannot reuse its source ID
• failed new/fork ID generation does not create partial session state

Checks

• go test ./...
• go vet ./...
• go test -race ./...
• three independent exact-head reviews completed with no actionable findings