[SDK/journal] Emit a terminal event (RUN_ABANDONED) + reconcile state on rejection-stop

[rogelsm]

Summary

When a run stops on a rejection, emit a terminal RUN_ABANDONED event, reconcile the state cache so journalHead.seq matches the journal entries, and add a doctor check for runs left without a terminal event.

Motivation / Evidence

cookbook native-apps-bugfix-jun-06 stopped on a rejection with NO RUN_COMPLETED/RUN_ABANDONED terminal event; the state cache desynced (journalHead.seq=5 vs 7 journal entries, rebuildReason='journal_mismatch'). A journal-only reader sees a healthy run that simply stopped, while the actual feature shipped 2 days later out-of-band.

Proposal

Emit RUN_ABANDONED (with reason + rejection text + optional pointer to shipping commits) when a run stops on rejection, reconcile the state cache so journalHead.seq matches entries, and add a babysitter:doctor check for runs left without a terminal event. Complements #880 (run:halt) by covering the implicit-abandon path.

Alternatives considered

• Reuse RUN_FAILED for rejection-stops — misleading, since a correct owner rejection is not a failure.
• Only fix the state-cache desync without a terminal event — a journal reader still cannot distinguish abandoned from paused.
• Leave it to run:halt (Add 'babysitter run:halt' command for sealing divergent runs #880) — that requires an explicit operator action and does not cover the implicit-abandon path seen here.

Related

• Add 'babysitter run:halt' command for sealing divergent runs #880 (run:halt) covers explicit sealing of divergent runs; R3 covers the implicit-abandon path where a run silently stops on rejection with no terminal event.

Reported from a cookbook babysitter retrospective (retro-jun-09) via /babysitter:contrib.