feat(acp): multiplex N concurrent ACP sessions + bash task ownership (RFC 011)

Lifts the RFC 010 single-session-per-connection cap: the bridge now runs N
concurrent sessions over one connection, each mapped to its own LoopAgent.

- packages/acp: live sessions held in a Map<sessionId, SessionRecord> with an
  agent→sessionId reverse WeakMap so agent/* events (which carry only the
  Agent) demux in O(1). Every session/event and agent/status is routed strictly
  to its owning record — concurrent sessions never cross-settle or interleave
  their session/update notifications. Per-session state: one in-flight prompt
  each, session/cancel aborts+settles only its own agent/prompt, session/load
  reserves a per-id load slot (distinct ids load concurrently; re-loading a live
  id is rejected), and disposal drains every live session in parallel to
  quiescence.
- packages/tool-bash: record each background task's owning agent at spawn and
  keep it for the executor's lifetime (NOT cleared on completion).
  bash_output/bash_kill reject a task owned by a different agent (a task with no
  owner is open; a no-agent caller can't access an owned task). Task ids are
  global and predictable, so this is the fence that stops one session's agent
  from reading/killing another session's background task.
- Per-session permission ownership and a per-agent disposer seam stay deferred
  (depend on the deferred permission gate); the reverse map the gate will route
  through is in place. RFC 011 stays `proposed`.
- Tests: two sessions stream concurrently without interleave; cross-session
  cancel isolation; per-session in-flight enforcement; dispose-all-to-quiescence;
  bash cross-session read/kill rejected (+ no-agent and unowned-task cases).
- Docs: RFC 011 implementation-status note; acp + tool-bash READMEs; example
  MVP-limitations updated. 100% per-file coverage maintained.

packages/acp/tests/harness.ts

@@ -107,8 +107,10 @@ export interface BridgeHarness {
   ctx: Context
   client: ClientSideConnection
   adapter: MockAdapter
-  /** Every `session/update` the bridge pushed, in order. */
+  /** Every `session/update` the bridge pushed, in order (payload only). */
   updates: CapturedUpdate[]
+  /** Same, but tagged with each update's `sessionId` (for multi-session demux assertions). */
+  sessionUpdates: { sessionId: string; update: CapturedUpdate }[]
   /** Permission requests the bridge issued (none until the gate lands). */
   permissionRequests: RequestPermissionRequest[]
   /** Decide each permission request's outcome (default: cancelled). */
@@ -181,11 +183,13 @@ export async function makeBridgeHarness(options: {
   const clientStream: Stream = ndJsonStream(clientOutput, a2c.readable)
 
   const updates: CapturedUpdate[] = []
+  const sessionUpdates: { sessionId: string; update: CapturedUpdate }[] = []
   const permissionRequests: RequestPermissionRequest[] = []
   const harness: BridgeHarness = {
     ctx,
     adapter,
     updates,
+    sessionUpdates,
     permissionRequests,
     onPermission: () => ({ outcome: { outcome: 'cancelled' } }),
     onSessionUpdateError: undefined,
@@ -204,6 +208,7 @@ export async function makeBridgeHarness(options: {
   const makeClient = (_agent: AcpAgent): Client => ({
     sessionUpdate(params: SessionNotification): Promise<void> {
       updates.push(params.update)
+      sessionUpdates.push({ sessionId: params.sessionId, update: params.update })
       // Let a test force the bridge's notify() error path.
       if (harness.onSessionUpdateError) return Promise.reject(new Error('client update rejected'))
       return Promise.resolve()