Add bounded runtime actor and live PTY pane

docs/decisions/0004-runtime-actor-owns-each-pty.md

@@ -0,0 +1,26 @@
+# 0004: A bounded runtime actor owns each PTY
+
+Status: accepted for the first local runtime slice.
+
+The desktop UI never owns or directly polls `PtySession`. A single runtime
+actor owns the PTY, child process, input ordering, resize ordering, output
+sequence, and process-tree cleanup. Its command and event channels are bounded,
+so a slow UI produces explicit backpressure instead of unbounded transcript
+memory.
+
+The first implementation runs this actor on a dedicated thread in the GPUI
+process. That is an implementation step, not the final deployment boundary. The
+commands and events remain free of GPUI types so they can move behind the
+versioned local IPC connection when the standalone `lumbridge-runtime` process
+arrives. Process-local session IDs are correlation IDs only; durable IDs are
+assigned by the persisted runtime protocol later.
+
+Runtime events contain ordered raw PTY bytes. The UI spike may line-frame plain
+fixture output for display, but ANSI/VT parsing, screen state, cursor behavior,
+scrollback, and terminal input modes belong to `lumbridge-terminal`. The UI must
+not infer terminal semantics from raw strings.
+
+Dropping the UI-side actor disconnects its bounded channels, releases an actor
+blocked by event backpressure, terminates the process group through
+`lumbridge-pty`, and joins the actor thread. Tests use only synthetic shell
+fixtures and never provider credentials or real transcripts.