Summary

• Add tracing::warn! when a Persistent cron session passes cron_session_warn_fraction (default 0.8) of its effective token budget — first signal of context pressure is now a structured log line, not a hard provider 400.
• Enrich GET /api/cron/jobs/{id} and GET /api/cron/jobs/{id}/status with session_message_count and session_token_count so dashboards / operators can graph growth trends.
• New docs/architecture/cron-session-sizing.md documents the existing prune knobs (cron_session_max_tokens, cron_session_max_messages), the new warn knobs, the API observability fields, and a "pick a strategy" matrix.

Why

cron_session_max_tokens / cron_session_max_messages (since #2989) already prune the persistent (agent, "cron") session before each fire. The umbrella issue #3693 flagged that operators still had no way to see growth coming: pruning prevents the 400, but only after the cap has been reached, and there is nothing to graph in the meantime. This PR fills that gap.

New KernelConfig fields

Both have #[serde(default = ...)] so older configs keep working.

New API response fields

On GET /api/cron/jobs/{id} and GET /api/cron/jobs/{id}/status:

Both default to 0 when the cron session does not exist yet (job has never fired, or only session_mode = "new" fires). Strictly additive; existing clients are unaffected.

Out of scope (follow-up under #3693)

Gentle summarize-and-trim compaction (replace the dropped tail with a short LLM-generated summary instead of pure drop-from-front). That requires a synthetic LLM round-trip per fire and is a larger change. Tracked under the same umbrella issue.

Implementation notes

• Pure-function resolve_cron_warn_threshold(max_tokens, warn_fallback, fraction) covers all the boundary conditions (NaN / Inf / negative / zero / >1.0 / both budgets unset). Unit-tested in crates/librefang-kernel/src/kernel/tests.rs.
• The prune block now only writes the session back to disk when at least one drain happened (was: write on every fire that entered the branch). Avoids touching SQLite on warn-only fires.
• Estimation reuses librefang_runtime::compactor::estimate_token_count (CJK-aware char-weighted heuristic — same as the prune loop). No new tokenizer dependency.

Verification

• cargo is forbidden from this worktree (multi-worktree contention rule from CLAUDE.md); CI runs the full workspace build, clippy, and librefang-api integration tests including the two new tests.
• New tests:
  • resolve_cron_warn_threshold_* (8 unit tests in kernel/tests.rs) — covers NaN / Inf / out-of-range fraction / zero budget / partial-token ceiling.
  • cron_job_get_response_has_session_size_fields — boots a real kernel via MockKernelBuilder, registers a cron job, seeds three messages into the cron session, asserts both fields present and non-zero on /api/cron/jobs/{id} and /api/cron/jobs/{id}/status.
  • cron_job_get_response_session_fields_default_zero_when_no_session — asserts both fields are 0 (not absent) when no cron session exists yet.
• OpenAPI drift hook (pre-push) re-generated as needed; if CI surfaces any spec churn it will be in the auto-bump PR loop the repo already runs.

Refs #3693