fix(agent-runner): self-heal poisoned-resume crash loop

[ddaniels]

Fixes #2669.

Problem. A session crash-loops forever on a corrupt resumed transcript (thinking/redacted_thinking blocks in the latest assistant message cannot be modified). The existing isSessionInvalid recovery never fires because the SDK surfaces this 400 as a result event, not a throw, and STALE_SESSION_RE wouldn't match it anyway. Manual deletion of the continuation:claude row was the only escape (twice in prod).

Fix.

• Add optional AgentProvider.isPoisonedResume(text) (optional → out-of-tree providers unaffected); implement on ClaudeProvider via a narrow POISON_RESUME_RE.
• In processQuery, when a result reports a poisoned resume, suppress the raw error text (it would only land as scratchpad + a pointless unwrapped nudge) and flag the result.
• In the outer loop, clear the continuation and retry the turn once from a fresh session — bounded to one retry, gated on having actually resumed, so a fresh session that still poisons can't loop.

A permanent crash-loop becomes at worst one dropped turn that auto-recovers.

Tests. Unit coverage for isPoisonedResume (matches the real 400, rejects benign/unrelated text) + an integration test that seeds a continuation, emits the poison as a result, and asserts the continuation is cleared and the fresh retry's clean reply is delivered. Full agent-runner suite (106) + container typecheck green.

Note. The real API 400 can't be triggered on demand; the integration test simulates it via a provider that emits the poison signature on resume — the realistic end-to-end proof.

🤖 Generated with Claude Code

[sturdy4days]

Ported this to our (heavily diverged) downstream fork today and can vouch for the approach: the result-path detection + bounded retry-once design is right, and the isPoisonedResume provider method composes cleanly even where the poll-loop has drifted a long way from main. We've hit the crash-loop this fixes twice in production (manual continuation:claude row deletion was our only recovery), so +1 to merging. The regex matched both real-world poison signatures we'd logged (thinking and redacted_thinking variants).