fix: harden workflow lifecycle, concurrency, and retries with structured errors

[liuedcson]

Features

• Structured provider error classification. AssistantMessage.errorKind (rate_limit | quota | auth | transient | invalid_request) is derived from the HTTP status, the provider's error type/code, and transport error codes. Mid-stream errors (Anthropic SSE error, OpenAI Responses error/response.failed) carry their code via ProviderStreamError, and ProviderRetryDelayError keeps the original error as cause. Retry decisions use errorKind first and fall back to message patterns only when no status or code is available.
• Separate 429 retry budget for sessions. retry.rateLimitMaxRetries applies only to errorKind === "rate_limit", honors Retry-After, falls back to jittered backoff (1s–30s), and can be cancelled.
• Shared admission window for subagents and workflows. Parallel subagent batches and workflow nodes take slots from one process-wide window, capped by a CPU-derived ceiling (optionally lowered by STEP_WORKFLOW_CONCURRENCY_LIMIT). Congestion control cuts the window by 25% per 429 epoch, recovers after four successes, honors Retry-After (capped at 30s), and keeps a throttled window for 60s between back-to-back runs.
• Large subagent batches. A subagent call accepts up to 1000 tasks and queues the tasks beyond its concurrency window.
• Content-addressed workflow resume. resumeFromRunId replays a completed call whose prompt and options are unchanged, regardless of its position. Failed, new, and changed calls run live; identical calls each consume one cached result.
  • Once a live call starts a write tool, a shell command, or an unrecognized tool (or cannot report its tool activity), only cached calls that used no file, shell, or network tools still replay.
  • Cached results are re-validated against the call's schema; calls with a runtime (safeParse) schema always run live.
  • Replayed calls are journaled under the resumed run's own sequence numbers.
• Workflow result reporting. Runs report partial_failed/failed with the failed nodes, callback failures as taskFailures (including nested workflows), requested vs. effective concurrency, and node timing. parallel() also accepts promise arrays.

Fixes

• A 400 response that mentions "429" is no longer treated as a rate limit, and a 429 whose code reports exhausted quota is terminal instead of retried.
• A provider stream that throws, ends without a terminal event, or fails during construction now finalizes the partial assistant message instead of leaving the turn unfinished; a stream that closes early is classified as transient.
• Tool results with isError: true keep their partial output and reach the model as errors; subagent results with failed or aborted children are marked as errors.
• Workflow shutdown cancels and drains running and queued children before publishing a terminal state, seals that state, and aborts the run scope when the tool call ends.
• Workflow node timeouts cover execution only (not queue time). Tokens reported by a cancelled or timed-out attempt are still charged, and a runner that ignores cancellation keeps its slot until it settles.
• Runs that return with unawaited operations fail instead of finishing silently; node failures are counted once and not reported again as callback failures.
• Journal, progress, and live-update write failures no longer replace a node's real error, and a failed progress write no longer blocks later writes.
• Workflow and parallel subagent children hold their admission slot until the process exits, so a child that is still shutting down or cancelling no longer overlaps the next queued task.
• Parallel subagent batches honor STEP_WORKFLOW_CONCURRENCY_LIMIT even when no workflow is running.
• Retry-After is preserved when the retry-delay cap rejects a wait, and an empty or non-numeric retry-after-ms is treated as absent.

Testing

• pnpm run check
• providers, agent-core, apps/cli, coding-agent test suites (the 3 failures in completion-check-cli.test.ts also occur on main: they need a Git worktree with a HEAD commit).