Add Devin Agent sessions to `xmd run`

[taras]

Story

As an executable-document author, I want to run Devin through the existing
<Agent>, <Session>, and <Prompt> components, so one xmd run invocation
can hold useful multi-turn Devin conversations without claiming that they can
be resumed later.

Example

xmd run --default-agent devin review.md

<Session name="review">
 <Prompt>Inspect the change and identify the highest-risk behavior.</Prompt>
 <Prompt>Turn that finding into a regression-test proposal.</Prompt>
</Session>

Both prompts reach the same live Devin conversation. Another named Session in
the same invocation has its own conversation and may run concurrently.

Current gap

ACPX documents Devin as a raw devin acp command rather than a built-in agent.
The current XMD registry therefore resolves devin incorrectly as the bare
command. Even with the command corrected, XMD's ordinary ACP path waits for the
durable first-turn materialization signal used by Codex and Claude. Devin emits
neither that signal nor a provider-native session identity, so treating it as a
durable session would either fail or retain an identity that nothing supports.

The sanitized discovery traces establish the narrower usable protocol boundary:
authentication, prompt streaming, normal completion, and ACP cancellation work
through ACPX's Devin compatibility shim, but it publishes no durable acceptance
or conversation identity. They inform this lifetime decision; reusable
qualification against a live backend belongs to #743.

Contract

xmd run recognizes the agent name devin and launches devin acp. Devin
Sessions are invocation-scoped:

• prompts in one Session are serialized and continue one live ACP conversation;
• different Sessions own different live conversations and may execute
  concurrently;
• cancellation targets the active turn without converting the Session into a
  durable one;
• invocation teardown cancels active turns, closes every owned handle, and
  retains no route, provider identity, or resumable session state; and
• the same document, directory, and Session name in a later invocation start a
  new Devin conversation.

ACPX remains in persistent mode while the invocation is live. Its bookkeeping
for Devin is held in an invocation-local store rather than the durable ACPX
store. The host declares that lifetime before agent availability is probed, and
the provider keeps invocation-scoped and durable runtimes separated so one
cannot consult the other's store.

Lifetime is also part of a provider-issued Session's compatibility. Two agent
names may resolve to the same command while the host declares different
lifetimes for them. A Prompt cannot consume a Session placed under another
lifetime merely because their commands match; the mismatch refuses before any
additional store access, route, ensure, turn, or retained write. Two aliases
declared with the same lifetime continue to share the command-derived placement.

No title update, ACP session id, ACPX record id, or
cognition.ai/userMessageId is promoted into a durable identity.

Other agents keep their existing placement, materialization, retention,
ownership, and native-launch behavior.

Unsupported surfaces

xmd workflow, replay continuation that requires a new model turn, and
<Session.Launch> do not support Devin because each requires durable session
continuity. Each refuses before probing, starting, or otherwise contacting
Devin.

Plan authorship is a separate host surface and remains outside this Story,
whether reached through the xmd plan command or through <Plan> in an
ordinary document run. Both entrypoints refuse Devin before contacting it. An
explicit --session or <Plan session> additionally requests continuity that
an invocation-scoped Devin session cannot provide.

xmd run --journal remains usable because its journal is a trace of the current
run and is not reopened as continuation state.

Acceptance

• xmd run --default-agent devin resolves the production command as
  devin acp.
• Two sequential prompts in one Session use one live conversation and the
  second can act on context established by the first.
• Two distinct Devin Sessions can have turns in flight concurrently, while two
  prompts for one Session remain ordered.
• Cancelling a turn sends ACP cancellation and settles the turn as cancelled.
  Provider teardown attempts every handle even when another close fails.
• The durable ACPX store receives no Devin record. A second provider invocation
  with the same cwd and Session names creates fresh backend conversations.
• xmd workflow, the xmd plan command, <Plan> in an ordinary document run,
  and <Session.Launch> refuse Devin with zero doctor, ensure, turn, and
  native-process calls.
• A mixed invocation cannot cross Devin's invocation-local records with a
  durable agent's records or runtime. Codex and Claude retain their current
  materialization behavior unchanged.
• Two names resolving to one command but declaring opposite lifetimes cannot
  consume each other's Session in either direction and cause no additional
  store, route, ensure, turn, or retention effect. The same-lifetime alias case
  remains valid.
• A credential-free black-box devin executable verifies the production argv,
  ACPX Windsurf client metadata and diagnostics exchange, same-invocation
  continuity, fresh later invocation, and absence of a durable record without
  credentials or model cost.
• Architecture, ACP-client, plan-command, workflow-session, and executable-MDX
  evidence contracts describe this supported boundary and its refusals without
  claiming live-backend certification.

Evidence

• Sanitized successful discovery trace:
  output.json
• Sanitized cancellation discovery control:
  cancellation-output.json
• Upstream command and compatibility contract:
  openclaw/acpx Devin documentation

Run the focused provider and host regressions explicitly:

deno task test packages/acp/tests/provider.test.ts
deno task test packages/cli/tests/agent-adapters.test.ts
deno task test packages/cli/tests/workflow-agent.test.ts
deno task test packages/cli/tests/plan-cli.test.ts
deno task test packages/cli/tests/plan-component.test.ts
deno task test packages/cli/tests/devin-agent.test.ts

The final command is the subprocess boundary: it runs a credential-free ACP
agent named devin through the production CLI and vendored ACPX shim.

Relationship

Closed issue #648 remains the durable first-turn materialization contract for
agents that publish its explicit acceptance signal. This issue does not weaken
or reinterpret that contract; it adds a host-declared invocation lifetime for
an agent that cannot satisfy it.

Issue #743 owns provider-neutral certification against real ACP-agent backends,
including the authorized Devin continuity, cancellation, teardown, and
sanitized-report requirements formerly included here. That cost-bearing
qualification does not delay this deterministic implementation.

Out of scope

• Durable Devin sessions or cross-invocation resume.
• Devin support in workflow continuation or any Plan-authorship surface.
• Native Devin Session.Launch.
• Inferring durable identity from display metadata or terminal response
  metadata.
• Patching ACPX's vendored registry or adding an npm dependency merely to name
  devin acp.
• Provider-state export, workflow-artifact portability, or conversation forking.
• Live-backend certification, which belongs to Certify ACP agents against real backends through xmd run #743.