[checkpoint] Resume claude_code_agent sessions

Parent

Child of #3221 and #3024.

Runtime state

responses_api_agents/claude_code_agent/app.py delegates authoritative continuation state to the Claude CLI process/session, workspace, configuration, transcript, and MCP session.

Provider adapter requirements

Implement the shared opaque-runtime contract with provider/version, native session or thread ID, safe-boundary sequence, isolated workspace/session bundle manifest and digest, model-call lineage, resource/MCP metadata, exact resume operation, and stale-process fencing. Advertise export/restore only after native resume is proven; otherwise declare restart-only explicitly.

Acceptance criteria

• Capture a real resumable Claude session ID and validate the workspace/config bundle before issuing the provider resume command.
• Kill and replace the agent server after each provider-emitted completed turn, then resume without duplicated model/tool effects.
• Session databases and workspaces are isolated by rollout attempt.
• Old processes cannot emit responses or mutate state after replacement.
• Missing, corrupt, or incompatible bundles fail restore before activation.
• Duplicate resume is idempotent or rejected deterministically.

Start with responses_api_agents/claude_code_agent/app.py and read parent issues #3221 and #3024 for the shared opaque-runtime contract. Verify native Claude session resumption and workspace/config bundle validation first. Done means all listed acceptance criteria pass, including isolation, stale-process fencing, restore validation, and deterministic duplicate-resume handling.