Move session persistence into the Agent; collapse CLI plumbing

The Agent now owns its Conversation and a SessionStore, and persists
everything it generates as turns progress. Embedders get persistence for
free; the CLI no longer drives the session log.

libpanto:
- Agent.init takes a SessionStore + optional Conversation to adopt (resume
  path). Agent owns/tears down the conversation; turn-driving methods drop
  the *Conversation param and operate on self.conversation.
- New Agent methods: submitUserMessage (adds+persists the user prompt
  immediately), addSystemMessage(text, mode), runStep persists the turn on
  every exit path (incl. partial turns on error), compactAndPersist for the
  explicit /compact path. Auto-compaction persists its window via runStep's
  tail.
- turn_persist.zig: DiskMessage mapping moved out of the CLI; reads usage
  off Message.usage (no per-message-usage list). System mode rides on
  DiskMessage.mode, derived from the System block.
- NullStore is now an allocator-bearing struct (frees consumed messages per
  the store-consumes-messages contract).
- Tests: in-memory CapturingStore round-trip + NullStore turn test.

panto CLI:
- Delete src/session_persist.zig. REPL is submitUserMessage + runStep.
- Reorder construction: store -> registry -> agent -> bootstrap -> seed/
  reconcile system prompt through the agent -> load extensions.
- command.Context drops conv/session_mgr; commands reach ctx.agent.
- system_prompt seed/reconcile call agent.addSystemMessage.
- CLIReceiver is display-only (per_message_usage removed).

Phases 3-5 of docs/pluggable-session-store.md. Behavior preserved; full
build + test suite green.

1 files changed, 8 insertions, 2 deletions

diff --git a/libpanto/src/session_store.zig b/libpanto/src/session_store.zig
index 83bf136..b929c66 100644
--- a/libpanto/src/session_store.zig
+++ b/libpanto/src/session_store.zig
@@ -85,8 +85,14 @@ pub const SessionStore = struct {
         /// Append a batch of messages atomically. `providers`/`models` are
         /// parallel arrays (one per message) carrying the top-level entry
         /// stamps (recorded on user entries). A single append is a
-        /// length-1 batch. Implementations consume nothing — the caller
-        /// retains ownership of `messages` and frees them after return.
+        /// length-1 batch.
+        ///
+        /// Ownership: the store **consumes** each `DiskMessage` on success
+        /// (takes ownership of its heap allocations). On error the store
+        /// frees any messages it had already taken and the caller frees the
+        /// rest — i.e. after this call returns the caller must not free the
+        /// `DiskMessage`s regardless of outcome. (The `messages` *slice*
+        /// itself remains the caller's.)
         appendMessages: *const fn (
             ctx: *anyopaque,
             messages: []DiskMessage,