refactor(cli): isolate exec lifecycle and failure contracts

[limityan]

Summary

• keep modes::exec as the stable facade while separating lifecycle/event settlement, Patch capture/write, and unit contracts into private owner files
• make structured completion deterministic: publish exactly one terminal envelope only after turn settlement and requested Patch delivery, and derive Ctrl+C races from the terminal that actually occurred
• add real CLI process contracts for provider HTTP 403, interrupted-stream retry failure, combined provider/Patch failure, PTY/ConPTY Ctrl+C, resize recovery, and bounded test-process cleanup

Product and Architecture Boundary

Type: refactor / reliability / test / CI / docs

Production ownership remains inside the existing CLI Exec mode. This PR does not add a user-facing feature, public DTO/event schema, generic executor, timeout/retry option, dependency, extension capability, HarmonyOS work, or Core/Runtime owner migration. It does not change GUI, TUI Chat, Server, Remote, or shared runtime behavior.

The existing text, json, and stream-json surfaces remain. The behavioral correction is limited to finalization: automation now receives one authoritative terminal and one stable BITFUN_EXIT classification after all requested delivery work is known.

Behavior and Risk Controls

Area	Before	After
Ctrl+C observation	terminal drain used a separate 1-second window and could publish before exact settlement	terminal observation and settlement share a bounded 5-second window; Completed/Failed/SystemError races keep their actual result
Tail projection	events consumed while cancelling could be omitted from text/JSON accumulation	terminal-preceding TextChunk, usage, model, and tool projection is buffered and replayed through the same private projector
Structured finalization	a turn terminal and a later settlement/Patch error could disagree or produce multiple classifications	one final terminal and one diagnostic, with explicit precedence: settlement failure > Patch failure > turn terminal
Provider contracts	failure coverage did not freeze the exact request/retry count	deterministic local HTTP fixtures assert one request for 403 and exactly two for disconnect plus one failed retry
Process-test bounds	process/output cleanup could wait indefinitely	runtime contracts use a 30-second process deadline; timeout cleanup uses bounded 2-second termination polling plus a shared 2-second pipe deadline; the CLI CI job has a 15-minute cap

Normal execution does not add provider requests, retries, polling, or a second event representation. The longer window is only entered after cancellation is requested; its worst-case latency increases from 1 to 5 seconds to preserve terminal and settlement consistency.

Verification

• cargo +1.95.0 fmt --all --check: passed
• git diff --check: passed
• node scripts/check-core-boundaries.mjs: passed
• cargo +1.95.0 check --locked --workspace: passed (with the same empty src/mobile-web/dist prerequisite used by CI)
• cargo +1.95.0 check --locked -p bitfun-cli: passed
• cargo +1.95.0 test --locked -p bitfun-cli -- --nocapture: passed (234 unit tests and all CLI integration targets, including 14 Exec contracts and 3 PTY/ConPTY process contracts)
• independent architecture, product, and reliability reviews were repeated after fixes; no submission blockers remain

Reviewer Notes

• The provider fixtures use a real local HTTP 403 and a real disconnected stream, but do not claim real-provider approval coverage.
• Remaining explicit follow-up: real-provider approval interaction, macOS active PTY coverage, and OS-level terminal initialization fault injection.
• Process cleanup is bounded; fixtures that intentionally spawn persistent descendants should later add Unix process-group or Windows Job Object ownership.
• The temporary execution plan, local build outputs, credentials, and generated artifacts are not included.
• AI-assisted change; adversarially reviewed and verified at workspace, CLI crate, protocol, and process-contract levels.

Checklist

• Scope is limited to the existing CLI Exec owner and its contracts.
• No secrets, generated scratch files, local lockfiles, or unrelated artifacts are included.
• Architecture and owner documentation match the implementation.
• Relevant local verification is recorded above.