P1: Implement idempotent ordered ManagedSession inbound events

[wms2537]

Parent

• Epic Epic: Implement the kertas.runtime/v1alpha1 ManagedSession contract #31
• Ordered work item 4

Dependency

• Depends on P1: Implement ManagedSession storage and active-Run admission #51

Scope

Add authenticated-source, idempotent inbound ManagedSession events with durable canonical receipt order and deterministic dispatch classification.

Required behavior

• Source identity is bound to the authenticated caller/configured connection, never self-granted by payload.
• Deduplication uses tenant + authenticated source + event ID and stores a canonical payload digest.
• Exact replay returns the original receipt; conflicting reuse returns 409 event_conflict.
• Concurrent first deliveries serialize and assign one monotonic session receivedSequence.
• current-run events match a durable wait contract and consume once; future-run events queue without interrupting the active Run.
• Large input transfer uses immutable digest-bearing snapshot references; signed URLs are not durable IDs.

Public seams under test

• authenticated POST /v1alpha1/sessions/:id/events
• ordered GET /v1alpha1/sessions/:id/events
• session Run list/state after queued event dispatch

Acceptance criteria

• duplicate and conflicting payload behavior is covered through HTTP
• concurrent receipt order is gap-free and deterministic
• unknown event types fail closed
• payload and snapshot-reference bounds are enforced
• crash/retry tests preserve one logical effect and canonical order
• exact-commit CI, independent review, and post-merge main evidence pass

[wms2537]

Closed by PR #57. Exact reviewed source commit: 1044ab3e949d6f07349e845b6855cd91fc2d1184; local controlled-alpha gate: PASS (release-evidence/2026-07-22T08-14-43-789Z); PR CI: 29903424443 PASS; merged main commit: e82c36c93d8099f433559855be03cc9bba95f6a7; post-merge main gate: 29903529410 PASS. Independent specification and standards reviews both passed the exact source commit.