code-mode: make pending frontiers generation-resumable

[cconger]

Why

A pausable cell needs a stable pending frontier. Repeated observation must return the same frontier without advancing execution, and resume must target the exact frontier the caller observed.

What

• Give each pending frontier a monotonic PendingGeneration.
• Require the generation when resuming a pausable cell.
• Return AlreadyRunning for an already-consumed generation and reject a future generation.
• Derive pending tool-call IDs from the actor's authoritative resolver map.
• Preserve an unobserved frontier across repeated waits and runtime failure.
• Cover parallel calls resolved one at a time.

Stack boundary

This PR establishes generation-safe pausing inside SessionRuntime. Continuing and pausable cells still share too much of the Rust type surface here; #29400 separates their capabilities. This is not yet a host/core protocol change.

Validation

• just test -p codex-code-mode
• Regressions cover repeated pending observations, stale and future resume generations, runtime loss, and parallel outstanding tool calls.

Stack parent: #29290.

[jif-oai]

Can we only consume the frontier after Continue is successfully sent?
If the runtime has already dropped control_rx, this currently clears the frontier and returns Resumed even though execution never resumed