[checkpoint] Resume prime_agent daemon sessions

Parent

Child of #3221 and #3024.

Runtime state

responses_api_agents/prime_agent/app.py delegates authoritative continuation state to the Prime daemon process, socket/session state, and workspace.

Provider adapter requirements

Implement the shared opaque-runtime contract with provider/version, native session or thread ID, safe-boundary sequence, isolated workspace/session bundle manifest and digest, model-call lineage, resource/MCP metadata, exact resume operation, and stale-process fencing. Advertise export/restore only after native resume is proven; otherwise declare restart-only explicitly.

Acceptance criteria

• Restore or reattach the daemon session while ensuring the old daemon and socket cannot publish after replacement.
• Kill and replace the agent server after each provider-emitted completed turn, then resume without duplicated model/tool effects.
• Session databases and workspaces are isolated by rollout attempt.
• Old processes cannot emit responses or mutate state after replacement.
• Missing, corrupt, or incompatible bundles fail restore before activation.
• Duplicate resume is idempotent or rejected deterministically.

Start with responses_api_agents/prime_agent/app.py and the parent issues #3221 and #3024 to understand the authoritative daemon, socket/session, and workspace state. The work is done when replacement and resume preserve provider turns without duplicate effects, isolate rollout state, fence old processes, reject invalid bundles before activation, and handle duplicate resumes deterministically.