feat(eve): add authenticated session hard delete

[0xKoller]

Summary

• add a framework-owned DELETE /eve/v1/session/:sessionId maintenance route
• require a separate built-in JWT policy and reject normal/user auth for permanent deletion
• cancel and purge the root plus $eve.root descendants through the provider-advertised Workflow runTreePurge capability
• return idempotent 204 for deleted/absent trees, retryable 409 for active conflicts, and keep unsupported deployments unavailable
• document the route and include an eve patch changeset

Refs #1211.
Depends on vercel/workflow#3115.

Release block

This PR must remain draft and must not be released until the Workflow contract and a real provider implementation are released. In particular, the managed Vercel World cannot advertise runTreePurge until its separately owned backend atomically fences and purges root-plus-descendant state. The capability check deliberately fails closed.

Verification

• focused unit tests: 124 passed (workflow-runtime.test.ts, eve.test.ts)
• pnpm --filter eve typecheck
• pnpm typecheck (32/32 workspace tasks)
• pnpm build
• pnpm lint
• pnpm guard:invariants
• pnpm docs:check
• git diff --check

The full workspace unit suite was also attempted twice. Under concurrent workspace load, unrelated 5-second import/dev-server tests timed out (for example load-agent-info-data, subagent-emitter, and wildcard-listener normalization); the changed hard-delete suites remained green. CI is the authoritative full-suite run.

[vercel]

@0xKoller is attempting to deploy a commit to the Vercel Team on Vercel.

A member of the Team first needs to authorize it.

[vercel]

Unsupported Workflow World (no runTreePurge capability) is reported to clients as a retryable 409 Conflict instead of 501 Unavailable, causing maintenance clients to retry a request that can never succeed.