Fix session confirmation lifecycle

[kiroro123]

Summary

• Move portal, mitmproxy, and plugin service startup behind final session confirmation in SessionRunner.
• Remove contradictory modules state from SessionPlan and keep only resolved execution intent.
• Type the runner backend with a protocol, update portal launch to netshaper.portal, and document external portal ownership.
• Add focused coverage for session_plan, session_runner, and portal_manager, with CI coverage gates for the new lifecycle components.

Validation

• .venv/bin/python -m coverage run -m pytest -q -> 363 passed, 5 skipped
• .venv/bin/python -m ruff check .
• .venv/bin/python -m mypy
• .venv/bin/python -m bandit -c pyproject.toml -r src/netshaper
• Coverage gates: session_plan 98.63%, session_runner 100%, portal_manager 99.13%, elevated combined gate 82.78%

Note

The local gh token is invalid, so this PR was created through the GitHub connector after pushing the branch over SSH.