…ssion-scoped stop

Implements issue #3172. Pre-change the kernel keyed `running_tasks` and
`session_interrupts` by `AgentId` only, so spawning a second concurrent
loop for the same agent (parallel `session_mode = "new"` triggers,
`agent_send` fan-out, parallel channel chats) silently overwrote the
prior abort handle and left the earlier loop un-stoppable.

Kernel
- Rekey `running_tasks` to `DashMap<(AgentId, SessionId), RunningTask>`
  where `RunningTask { abort, started_at }`.
- Rekey `session_interrupts` to `DashMap<(AgentId, SessionId), ...>`.
- Update every insert/remove site (streaming + non-streaming entry,
  cleanup on success/failure, dead-agent reaper).
- New methods:
  - `stop_session_run(agent, session)` — abort one entry.
  - `list_running_sessions(agent)` — snapshot for introspection.
  - `agent_has_active_session(agent)` — cheap "any in-flight" check
    used by the WS state-event gate.
  - `any_session_interrupt_for_agent(agent)` — fork lookup helper
    that picks any active session for the agent (forks chain off the
    parent's interrupt; choice is best-effort but cancellation cascades
    correctly because `stop_agent_run` fans out across all sessions).
- `stop_agent_run` now fans out across every `(agent, *)` entry,
  preserving the existing public semantics of
  `POST /api/agents/{id}/stop` ("abort all sessions for this agent").
- `suspend_agent` reuses `stop_agent_run` for the same fan-out.

Types
- `RunningSessionSnapshot { session_id, started_at, state }` and
  `RunningSessionState::Running` for the wire shape. The state enum
  is single-variant today; finer-grained sub-states (WaitingLLM,
  ExecutingTool) are a separate follow-up that requires the agent
  loop to write back its current step.

API
- `GET /api/agents/{id}/runtime` — snapshot of in-flight loops.
- `POST /api/agents/{id}/sessions/{session_id}/stop` — abort one
  `(agent, session)` loop without affecting the agent's other
  concurrent sessions. Scoping under `/agents/{id}/...` rather than
  the issue's suggested `/api/sessions/{id}/stop` removes the need
  for a session-to-agent reverse lookup and prevents cross-agent
  confusion.
- WS `queue` command migrated from `running_tasks_ref().contains_key`
  to `agent_has_active_session`.
- OpenAPI registers both new handler paths.

CLI
- `librefang sessions` gains a STATE column showing `running` / `idle`
  per session, populated by calling the new runtime endpoint once
  per unique agent in the listing.
- `--active` flag filters to currently-executing sessions only.
- JSON output annotates each entry with `state` so scripts see the
  same signal as the table renderer.

Tests
- Three new kernel tests covering: two concurrent sessions on one
  agent are independently abortable, `stop_agent_run` fans out and
  doesn't leak across agents, `stop_agent_run` on an idle agent
  returns false. Existing cascade tests updated to the new map shape
  via `any_session_interrupt_for_agent`.

Refs #3172

The followup commit added api-error-session-invalid-id under the
"Agent errors" section in all six locales, but the key already lived
in the "Session errors" section in en/errors.ftl (line 52) and
ja/errors.ftl (line 51). Fluent rejects duplicate identifiers as a
parse error; ErrorTranslator silently falls back to EN_FTL for the
broken bundle, which is why ja.t("api-error-agent-not-found") was
returning "Agent not found" even though the source file had the
Japanese translation. CI failed on three platforms with that exact
panic.

Drop the duplicate. The original entries in the Session errors
section stay; de/es/fr/zh-CN are unaffected.