Implement P2/P3: Plan-Run flow separation, PlannerService, and Windows test fixes

## P3: Session/Planning Foundation

### PlanAsync / RunAsync flow separation (Design §8.4)
- AgentRuntime.ExecuteAsync now follows a two-phase lifecycle:
  1. Planning: generate Initial TaskGraph via Ollama structured output
  2. Running: execute ready Tasks (dependencies satisfied) in
     critical-path then creation order
- Sandbox Task Resource (BeginTask/EndTask) is applied at RunAsync
  time, not PlanAsync time (Design constraint)
- QueuedTaskWorker transitions to Planning; ExecuteAsync transitions
  to Running internally

### PlannerService (new: src/Agent.Core/Runtime/PlannerService.cs)
- PlanAsync: uses Ollama ChatStructuredAsync with JSON Schema to
  generate a TaskGraph with per-Task requires_external_effect
- ReplanAsync: rebuilds TaskGraph after policy deny, preserving
  completed tasks (Design §8.4)
- Fallback: single-task plan with conservative estimates when
  structured output fails or returns empty
- Pure analysis tasks get RequiresExternalEffect=false with at
  least 1 Task (Design constraint)

### PlanResult / PlanSchema (new: src/Agent.Core/Runtime/PlanResult.cs)
- JSON model for LLM structured output during Planning
- JSON Schema with tasks array: description, dependencies (by index),
  budget_class, PERT estimates, requires_external_effect

### requires_external_effect integration (P2 + P3)
- Removed keyword heuristic RequiresExternalEffect() from AgentRuntime
- Removed tool-name-counting RequiredToolCalls() from AgentRuntime
- ToolUseGuard now receives PlannerTask.RequiresExternalEffect
  (set by Planner during Planning, not by keyword matching)
- requires_external_effect is NOT always true; it is a per-Task
  attribute determined by the Planner (Design constraint)

### RunAsync / ready Task execution
- SelectNextReadyTask: dependencies satisfied, not completed/failed,
  critical path first then creation order
- Each PlannerTask executed via ExecutePlannerTaskAsync (LLM
  chat-with-tools iteration loop)
- TaskGraph.AddUsage records per-Task token usage for CPM tracking

### Replan implementation
- Policy deny (InvalidOperationException with "denied by sandbox
  policy") triggers ReplanAsync, up to max 3 replan attempts
- Failed task is marked Failed in TaskGraph before replan
- Registry transitions back to Running for replan iteration

## P3-A: AgentSession + TaskGraph ownership

### AgentSession expansion (src/Agent.Core/Sessions/AgentSession.cs)
- Added Summary, ExecutionResults, TaskGraphs
  (ConcurrentDictionary<Guid, TaskGraph>)
- TaskGraph is per-MCP-Task (1 agent_run = 1 TaskGraph), NOT shared
  per-Session (Design constraint)
- Added CompactConversation, CompactExecutionResults, SetSummary
  methods for context summary compaction

### ExecutionResult (new: src/Agent.Core/Sessions/ExecutionResult.cs)
- Records tool execution results in session for context summary
- Fields: TaskId, ToolName, Success, Output

### SessionStore (src/Agent.Core/Sessions/SessionStore.cs)
- Added Sessions property for TaskGraphToolHandler to resolve graphs
  by TaskId across sessions

### sessionId threading
- IInternalToolBackend.BeginTaskAsync signature changed to include
  sessionId parameter
- InternalToolDispatcher, WindowsToolBackend, TaskGraphToolHandler
  updated to thread sessionId through
- task_update schema includes requires_external_effect property
- McpHost and Program.cs pass SessionStore to TaskRegistry

## P3: Context Summary (Design §9.3)

- Context utilization = latest prompt_eval_count / num_ctx
  (NOT cumulative InputTokens) (Design constraint)
- TryContextSummary: compacts old Conversation/ExecutionResults when
  utilization exceeds 80% threshold
- AgentRuntimeSettings: added NumCtx, ContextSummaryThreshold,
  ConversationKeepLastN, ExecutionResultsKeepLastN
- OllamaResult: added PromptEvalCount field
- OllamaClient: passes PromptEvalCount from OllamaChatResponse

## P3: ExecutionResults Session recording

- ExecutePlannerTaskAsync records each tool execution result via
  session.AppendExecutionResult for context summary and audit

## Windows test fixes

### SandboxPolicyException catch (src/Agent.Windows/Tools/WindowsToolBackend.cs)
- ExecuteAsync now catches SandboxPolicyException and returns
  ToolExecutionResult(false, ..., RetryAllowed: false) instead of
  propagating the exception
- Fixes Dir_mkdir_outside_approved_root_is_denied and
  File_edit_rename_rejects_outside_approved_root tests

### LoopbackExemption cleanup (tests/Agent.Windows.Tests/SecurityPolicyTests.cs)
- Recovery_after_crash: added pre-clean and try/finally to ensure
  LoopbackExemption is always removed, even on assertion failure
- Independent_process_crash: added pre-clean to remove residual
  loopback exemption from prior test failures
- Fixes 7 Independent_process_crash scenarios that were failing due
  to LoopbackExemption residue from Recovery_after_crash

## Test updates (tests/Agent.Core.Tests/PromptAndRuntimeTests.cs)

- FakeOllamaClient implementations updated with ChatStructuredAsync
  and ChatWithToolsAsync overrides to support Plan/Run flow
- RecordingOllamaClient: returns single-task plan JSON for
  ChatStructuredAsync, tracks all call types
- ToolCallingOllamaClient: returns plan with
  requires_external_effect=true for file edit tasks
- Test expectations updated for Plan+Run call counts and token
  accounting (Plan tokens not added to registry usage)

## Documentation updates

- Design.md §7.7: requires_external_effect is set by Planner during
  Planning, not keyword heuristic
- Design.md §8.4: Plan/Run phase separation, replan after policy deny
- Design.md §9.3: context utilization formula clarified
- ImplementationPlan.md §10.3: Plan/Run flow, replan, Context Summary

## Test results (all passing)

- Agent.Core.Tests: 61/61
- Agent.Planner.Tests: 10/10
- Agent.Windows.Tests (elevated): 41/41
- Build: 0 errors, 0 warnings

1 files changed, 52 insertions, 10 deletions

diff --git a/src/Agent.Core/Tools/TaskGraphToolHandler.cs b/src/Agent.Core/Tools/TaskGraphToolHandler.cs
index 03daa56..edc1cc5 100644
--- a/src/Agent.Core/Tools/TaskGraphToolHandler.cs
+++ b/src/Agent.Core/Tools/TaskGraphToolHandler.cs
@@ -1,30 +1,46 @@
 using System.Collections.Concurrent;
 using System.Text.Json;
+using Agent.Core.Sessions;
 using Agent.Planner;
 
 namespace Agent.Core.Tools;
 
 public interface ITaskUpdateHandler
 {
-    void BeginTask(Guid taskId);
+    void BeginTask(Guid taskId, Guid sessionId);
     ToolExecutionResult Execute(Guid taskId, JsonElement arguments);
     void EndTask(Guid taskId);
 }
 
-public sealed class TaskGraphToolHandler(int maxTasks = 32) : ITaskUpdateHandler
+public sealed class TaskGraphToolHandler(int maxTasks = 32, SessionStore? sessions = null) : ITaskUpdateHandler
 {
-    private readonly ConcurrentDictionary<Guid, TaskGraph> _graphs = new();
+    private readonly ConcurrentDictionary<Guid, TaskGraph> _fallbackGraphs = new();
 
-    public void BeginTask(Guid taskId)
+    public void BeginTask(Guid taskId, Guid sessionId)
     {
-        if (!_graphs.TryAdd(taskId, new TaskGraph(maxTasks)))
-            throw new InvalidOperationException($"TaskGraph for '{taskId}' already exists.");
+        TaskGraph graph = new(maxTasks);
+        if (sessions is not null && sessions.TryGet(sessionId, out AgentSession? session) && session is not null)
+        {
+            if (!session.TaskGraphs.TryAdd(taskId, graph))
+                throw new InvalidOperationException($"TaskGraph for '{taskId}' already exists in session '{sessionId}'.");
+        }
+        else
+        {
+            if (!_fallbackGraphs.TryAdd(taskId, graph))
+                throw new InvalidOperationException($"TaskGraph for '{taskId}' already exists.");
+        }
+    }
+
+    public TaskGraph? GetGraph(Guid taskId, Guid? sessionId = null)
+    {
+        if (sessionId is not null && sessions is not null && sessions.TryGet(sessionId.Value, out AgentSession? session) && session is not null)
+            return session.TaskGraphs.TryGetValue(taskId, out TaskGraph? g) ? g : null;
+        return _fallbackGraphs.TryGetValue(taskId, out TaskGraph? fallback) ? fallback : null;
     }
 
     public ToolExecutionResult Execute(Guid taskId, JsonElement arguments)
     {
-        if (!_graphs.TryGetValue(taskId, out TaskGraph? graph))
-            throw new InvalidOperationException("TaskGraph scope is not active.");
+        TaskGraph? graph = ResolveGraph(taskId) ?? throw new InvalidOperationException("TaskGraph scope is not active.");
 
         string operation = arguments.GetProperty("operation").GetString()!;
         switch (operation)
@@ -35,6 +51,7 @@ public sealed class TaskGraphToolHandler(int maxTasks = 32) : ITaskUpdateHandler
                     Budget(arguments),
                     Estimate(arguments),
                     Ids(arguments, "depends_on"),
+                    requiresExternalEffect: OptionalBool(arguments, "requires_external_effect"),
                     id: OptionalId(arguments, "task_id"));
                 break;
             case "add_dependency":
@@ -61,7 +78,8 @@ public sealed class TaskGraphToolHandler(int maxTasks = 32) : ITaskUpdateHandler
                 description = task.Description,
                 depends_on = task.Dependencies,
                 state = task.State.ToString().ToLowerInvariant(),
-                expected_tokens = task.ExpectedTokens
+                expected_tokens = task.ExpectedTokens,
+                requires_external_effect = task.RequiresExternalEffect
             }),
             critical_path = graph.CriticalPath.TaskIds,
             critical_path_tokens = graph.CriticalPath.CumulativeTokenCost,
@@ -70,7 +88,31 @@ public sealed class TaskGraphToolHandler(int maxTasks = 32) : ITaskUpdateHandler
         return new ToolExecutionResult(true, output, false);
     }
 
-    public void EndTask(Guid taskId) => _graphs.TryRemove(taskId, out _);
+    public void EndTask(Guid taskId)
+    {
+        // Remove from fallback dict; session-owned graphs persist for context summary.
+        _fallbackGraphs.TryRemove(taskId, out _);
+    }
+
+    private TaskGraph? ResolveGraph(Guid taskId)
+    {
+        // Search all sessions first, then fallback.
+        if (sessions is not null)
+        {
+            foreach (AgentSession? session in sessions.Sessions)
+            {
+                if (session is not null && session.TaskGraphs.TryGetValue(taskId, out TaskGraph? g))
+                    return g;
+            }
+        }
+        return _fallbackGraphs.TryGetValue(taskId, out TaskGraph? fallback) ? fallback : null;
+    }
+
+    private static bool OptionalBool(JsonElement arguments, string property)
+    {
+        if (!arguments.TryGetProperty(property, out JsonElement value)) return false;
+        return value.ValueKind == JsonValueKind.True;
+    }
 
     private static TokenBudgetClass Budget(JsonElement arguments) =>
         TokenBudgetClassExtensions.Parse(RequiredString(arguments, "budget_class"));