V2: implement session shell execution (publisher, route, TUI composer) #35056

Split out of #35018 (part of the #35021 event audit). The audit aligns the session shell schema with the Shell service (session.shell.started { shell: Shell.Info } / session.shell.ended { shell, output: Shell.Output }, projected SessionMessage.Shell reusing the same types). This issue is the missing implementation — today the V2 shell events have no publisher:

• SessionV2.shell is a stub returning OperationUnavailableError (packages/core/src/session.ts)
• There is no V2 protocol route for session shell (only server.shell)
• The TUI composer shell mode still posts to the legacy V1 route (packages/tui/src/component/prompt/index.tsx → V1 session.shell), which emits V1 message events

Work

1. Implement SessionV2.shell({ sessionID, command }): resolve the session's Location services (same pattern as compact), Shell.Service.create(...) with metadata: { sessionID }, publish session.shell.started { shell }, wait + fetch output, publish session.shell.ended { shell, output }.
2. Add the V2 protocol route (packages/protocol/src/groups/session.ts) + server handler, regenerate clients.
3. Switch the TUI composer shell mode to the V2 endpoint.
4. Integration test: shell start → prompt admitted mid-shell → assert deterministic ordering.

Recorded direction (from the audit grill)

• Concurrency: session shell occupies the session's run-coordinator slot (serialized with assistant drains — a prompt admitted mid-shell wakes after the shell settles). Deterministic, no running-shell placeholders. Revisit richer concurrency later.
• Durable shell.ended embeds Shell.Output truncated to a fixed cap with truncated: true; full output remains fetchable from the Shell service while the shell exists.

Blocked on the #35018 schema alignment landing first.