Add resumable standalone sourcehunt sessions

[auroter]

Summary

• add schema-versioned, atomically replaced standalone sourcehunt checkpoints plus a per-session process lock
• add clearwing sourcehunt --resume SESSION_ID with repository/config/commit compatibility checks and fresh provider credential resolution
• restore ranked targets, completed stages, work-item state, findings, verification/exploitation progress, and lifetime spend without duplicating durable artifacts
• classify Kimi-compatible HTTP 403 access_terminated_error quota responses as provider_exhausted, stop new scheduling, cancel active work safely, checkpoint, and print the exact resume command
• define resume budget as the total lifetime session cap; it may be raised or made unlimited but not lowered
• document that only newly checkpointed standalone legacy-flow sessions are supported; proof flow and legacy sessions without checkpoint.json are rejected

Verification

• 85 passed: focused resume, CLI compatibility, spend-ledger, native LLM fallback, runner, and pool-budget tests
• edited-file Ruff checks passed
• Python byte-compilation passed for core edited modules
• git diff --check passed
• full sandboxed suite: 2890 passed, 26 skipped, 54 failed. The remaining failures are restricted-environment failures in untouched areas: writes under the user home directory, loopback socket binds, and Docker/Colima access.

Includes a runner-level provider exhaustion to replacement-credential resume test. No live provider call was performed.

[auroter]

Closing, this got clobbered and the architecture was sub-par.