fix(server): decouple session controls from Location startup

[kitlangton]

Why

Waiting for or interrupting a Session currently acquires its Location graph before reaching process-local execution. A cold or unavailable Location can therefore delay or block cancellation even though the active execution is already owned by this process.

What Changes

Only session.wait and session.interrupt use validation-only middleware. It shares the original ID decoder and existence lookup with Location middleware, but does not acquire filesystem, plugin, tool, or model services.

Request	Result
Wait for an idle Session	Return without booting its Location
Interrupt an idle Session	Return interrupted: false without booting its Location
Interrupt active work with a cold/unavailable Location	Acknowledge interruption immediately; cleanup remains asynchronous
Wait during cleanup or continuation	Wait until the existing execution ownership chain settles
Malformed or unknown Session ID	Preserve the exact 400/404 response, before invalid query decoding

Actual drains still acquire their Location through SessionExecution. Tests exercise both continue values, preserve queued prompts, and show that only real continuation constructs a replacement Location graph.

Scope

No Core execution change. Prompt, synthetic, and compaction admission retain Location middleware and their event attribution. Includes Protocol/Server patch changesets; client regeneration produces no diff. Independent of the manual-compaction refactor in #45335.

Verification

# packages/server (isolated configuration)
bun run ../core/script/test.ts test/session-controls.test.ts
bun run ../core/script/test.ts test
bun run ../core/script/test.ts test -t '^(?!.*OAuth)'
bun typecheck

# packages/sdk (isolated configuration)
bun run ../core/script/test.ts test
bun run ../core/script/test.ts test/embedded.test.ts -t 'session controls' --rerun-each 5
bun typecheck

# packages/core
bun run script/test.ts test/session-execution.test.ts test/session-run-coordinator.test.ts

# packages/protocol
bun run ../core/script/test.ts test
bun typecheck
bun run check:generated

# packages/client
bun run generate
bun run check:generated
bun typecheck

• Control endpoint tests: 3 passed, 79 assertions. Embedded lifecycle tests also fail against the original Location middleware as expected.
• Full SDK suite: 26 passed; 10 cleanup-case executions passed (two cases, five repetitions).
• Core execution/coordinator: 42 passed. Protocol: 8 passed.
• All four affected-package typechecks passed. Formatting, Oxlint, and git diff --check passed.
• Workspace pre-push typecheck passed all 32 tasks.
• Full Server suite: 35 passed, 1 skipped, 3 existing OAuth callback-port failures. All three reproduce with changed production files restored byte-for-byte to the base revision. Excluding those OAuth cases: 35 passed, 1 skipped.
• Protocol check:generated reports an already-stale OpenAPI snapshot involving unrelated integration metadata, model reasoning, VCS, and streamed-timestamp fields. Regeneration contained no control-endpoint changes; that unrelated output is excluded. Client generation and its generated-file check pass without changes.