Write nothing of a retired session again

[wu-sheng]

A retired session is one whose marker _retired/<session> is in the root: an empty file named by its id. Nothing makes one yet. The level that retires a session (storage.retention.retire_after) comes in the next change, together with its docs and changelog entry, so no setting exists before its behavior. This change makes every writer leave a retired session alone first. A session retired once is then never collected, derived, parsed or sent again, whatever is left of it on disk.

What changes

• The marker. storage.Retired and storage.RetiredSessions read _retired/. A marker that cannot be read is an error, never taken for no marker. A writer that meets one changes nothing of that session in that pass.
• Every writer checks it before it creates a session or chain directory, or takes a lock that would create one:
  • Claude Code, the change recorder and Kiro pass over a retired source session. Lost-source marking skips it.
  • Provider bodies of a retired session are marked retired in seen.state and never read again. A response is attributed through a retired request too. A marker that cannot be read leaves seen.state as it was.
  • LangSmith: a run whose conversation is decided and retired never waits. It is remembered in that conversation. Its later updates, and runs inside it, are then known to be retired too, after a restart and after the run above it is forgotten. A run whose conversation is not decided yet waits as before.
  • asz parse, the metrics deriver and an SD-format scenario build do nothing for a retired id. A marker the deriver cannot read keeps the first pass's look-back.
  • asz push sends no landed file of a retired session. It still reads each round under a retired session's conversation directory by the session in the round's header. Spooled metrics requests still go.
  • asz repack and the scenario runner refuse a root holding a retired session, and a destination where the session is retired. The runner copies only into a new directory.
• What a person sees. The pass log says each retired session once per process:

    retired: <session>: found and not collected; a retired session is never collected again
  

  asz sources names them for every adapter, and asz verify counts them.

Tests

• tests/chain, TestARetiredSessionIsNeverWrittenAgain: all-kinds and provider-bodies-long, each with what is left of the session in four states: everything but its index, its directory alone, its chain alone, and nothing. The provider's seen.state is lost each time, and the sources grow. Nothing under the session or chain changes, no file of it is sent, and every spooled metrics request reaches the receiver.
• tests/chain, TestARoundOfALiveSessionUnderARetiredDirectoryIsSent, and TestRepackRefusesARetiredSession for direct calls and unreadable markers.
• Each collector, given new evidence of a retired id: Claude Code, Kiro, the provider (its fast path, a leftover directory, an unreadable marker then recovery), and LangSmith (a run naming the conversation inside a missing parent, a threadless call, a sparse update, an update before its start, an unassigned conversation, a restart, the defer limit, a call that outlives its function, an unreadable marker).
• The metrics deriver, an SD scenario build, the runner's copy (source and destination), the storage marker reads, and the pass log (exactly once per process), asz sources and asz verify.

Each new guard was proven by reverting it. make test, the JSON v1 step (GOEXPERIMENT=nojsonv2), make scenarios, lint, and the Windows build and vet pass.