Goal-mode round driver re-claims blindly after errors/cancel; quit leaves orphan rounds

Description

The goal-mode round driver (SessionPrompt.loop) re-claims unconditionally on every normal ensureRunning return, but that return is normal for three different outcomes: the single-flight Runner converts user cancel into its registered onInterrupt value for joiners (so the loop's onInterrupt(pauseOnCancel) never fires), and the processor converts provider failures into error-bearing "stop" results. Net: deterministic provider errors hot-retry burning the round budget, the stop button does not stop the loop, and quit/crash between admit-and-run leaves orphan synthetic goal_round messages with rounds spent.

Reproduction

1. Run a goal-mode session against a stubbed HTTP 400 provider error (or press stop / quit mid-round)
2. Observe: the loop re-runs the round instead of pausing (errors), cancel does not pause, quit leaves trailing unexecuted synthetic goal_round messages
3. Expected: cancel pauses at once; dead rounds pause after 3 consecutive (2 when non-retryable); no orphan rounds after quit

Environment

• opencode v1.18.29 source build + a local goal-mode extension (same-session round driver + /goal command, cf. #48240) on Linux. The re-claim mechanics (Runner cancel conversion, error-to-stop conversion) live in upstream session core (packages/opencode/src/session/), so the underlying hazard likely affects any driver built on SessionPrompt.loop.

Suggested fix

A GoalDriver.assessRound classifier per round from the last assistant message (productive / cancelled via MessageAbortedError / dead with APIError.isRetryable); a reconcile() retracting trailing unexecuted synthetic rounds via removeMessage + CAS. Fault-injection regression test included in the local patch; available on request.