fix(runtime): repair missing terminal runtime ledgers

[Astro-Han]

Summary

• Ensure AiSdkFlow always closes exhausted assistant streams with a terminal runtime event.
• Repair persisted session ledgers before model-context reads when a terminal run is missing its terminal RuntimeEvent fact.
• Add regression coverage for new stream exhaustion, AgentRun finalization, and legacy session repair paths.

Why

Fixes#397

A backend stream could end after non-terminal output or an error without producing a terminal runtime event. The run could then be finalized as terminal, but replaying the session later failed because the runtime event ledger had no terminal fact. This fixes the invariant at write time and repairs already-persisted broken ledgers before they are read.

Scope

Changed:

• AiSdkFlow synthesizes failed terminal events when a stream exhausts without one, while preserving the original error event when there is one.
• AgentRun no longer defaults an unclassified finalization to completed; missing terminal evidence becomes missing_terminal_event, and stopped runs stay aborted.
• SessionManager repairs missing terminal runtime facts from durable legacy events when available, or records a failed missing_terminal_event terminal when there is no trustworthy legacy terminal.
• Tests now cover the prevention path, empty-ledger backfill, non-empty ledger repair, and the no-evidence fallback.

Not included:

• UI changes, schema migrations, or benchmark harness changes.

Verification

• npm run typecheck
• npm run -w @maka/runtime test
• git diff --check

User-facing impact

No UI changes. Previously broken sessions with missing terminal runtime facts should become readable and retryable again, and future runs should close as failed instead of becoming terminal without terminal evidence.

Reviewer notes

This is intentionally one PR: prevention and repair are the same runtime invariant. Splitting them would either leave old ledgers broken or allow new broken ledgers to keep being written.

[jackwener]

Merged! 🎉 Thorough, well-tested fix — the terminal-fact invariant is enforced consistently across AgentRun, SessionManager, and the read models, and the regression coverage (prevention, empty-ledger backfill, non-empty repair, and no-evidence fallback) is excellent.

Two notes from review:

• Rebase integration: main's heavy-task self-check gate added a second runRuntimeAttempt() call site (the repair path) after you made requireTerminalRuntimeEventWrite required. I wired it through there (Boolean(runtimeEventStore), matching the primary site) and imported isTerminalRuntimeEvent into task-agent-controller.ts. Full suite green afterward (core 671 / storage 139 / runtime 803 / headless 673).
• I considered whether repairMissingTerminalAsFailed downgrading a header-completed run with no corroborating turn_state to failed was too aggressive, but concluded it's the correct conservative call given Assistant runs can silently finalize as 'completed' without a terminal RuntimeEvent, permanently breaking the session (stuck 'streaming' UI + RuntimeReadModelError) #397 — trusting run.status alone would reintroduce the exact 'terminal without terminal evidence' state this PR removes. Left as-is.