0011 - add session manager core and config controls

[ethanbailie]

With persistence in place, this PR adds the core session lifecycle service (create/send/poll/terminate + reaper) and session-specific server configuration controls.

What Changed

• Added session config controls + env overrides in tako_vm/config.py

  • sessions_enabled
  • timeout/message/poll limits
  • optional model cache volume with validation

• Added SessionManager in tako_vm/server/sessions.py

  • create session container
  • send inbox event with payload size checks
  • poll outbox events with ingestion and cursoring
  • terminate session and cleanup workspace
  • background reaper loop for idle/TTL expiry
  • explicit error mapping via SessionManagerError

Tests Added

• tests/test_sessions.py
  • lifecycle coverage (create, send, poll, terminate)
  • disabled-session gate
  • invalid JSON outbox normalization
  • workspace cleanup behavior
• Test design uses minimal mocking:
  • real storage + filesystem paths
  • only subprocess boundary (_run_subprocess) is mocked

How To Review

1. Review tako_vm/config.py for new field validation and env parsing.
2. Walk tako_vm/server/sessions.py in lifecycle order:
   • create_session -> send_event -> poll_events -> terminate_session
3. Review reaper behavior and timeout enforcement.
4. Confirm robustness in tests/test_sessions.py (functional behavior over implementation details).

Suggested Verification

• ruff check tako_vm tests
• pytest tests/test_sessions.py tests/test_config.py -v

Out of Scope

• No API route surface yet (added in next PR).
• No docs/CLI exposure yet.