Provide a supported no-turn Claude exact-prefix Agent bundle lifecycle

[taras]

Non-blocking follow-up to #599. Frozen by plan commit b42339b3d6df869d65e4b34a8ba89f60728f8a58 after independent Architect PASS.

Outcome

Prove or provide a supported Claude operation that materializes resumeSessionAt + forkSession at a selected assistant-message UUID without executing a Prompt or appending any provider message.

The tested claude -p command is excluded evidence because it selects the prefix and then executes a new Prompt. Until a supported no-turn surface exists and passes review, Claude bundle capability remains undeclared, exports write an explicit unavailable marker, and post-Prompt artifact checkpoints remain agent-state-unavailable. The first live Prompt cannot be fused into fork admission.

Required capability

• Use caller-allocated destination Claude session identity.
• Transport the transcript as opaque confidential bytes and preserve the source.
• Verify the exact UUID prefix with no later or unauthored message.
• Enumerate every projects/*/<session-id>.jsonl claimant across the complete destination root, not only the current working directory.
• Apply zero claimant, one matching claimant, one different-content claimant, and multiple claimant (including equal hashes) decisions before provider resume, mutation, publication, run storage, or journal append.
• Record XMD lineage because Claude supplies no provider ancestry.
• Exclude destination authentication from the bundle.

This follow-up cannot weaken assertion-before-mapping, use ACP head-only session/fork, synthesize a transcript/token, or expose the lifecycle to authored Markdown or retained-run fork.

Acceptance and evidence

• A supported no-turn exact-prefix materialization surface exists and appends no Prompt/message.
• Source transcript and transported bundle remain byte-identical.
• Returned destination contains the exact requested assistant-message UUID prefix and no later message.
• Complete-root claimant enumeration passes the frozen zero/one-match/one-different/multiple-even-equal matrix.
• Every refusal precedes provider resume, mutation, publication, discoverable run storage, and journal append.
• Caller-selected identity and XMD lineage reconcile safely across retries.

Dependencies

• Retain provider checkpoint tokens for workflow Agent Prompts #622
• Finalize XMD artifact V1 with Agent portability evidence #621
• Add the trusted Agent bundle lifecycle with Codex exact-prefix support #624

This issue is not a quest-completion dependency. Qualified Codex portability satisfies #599 while Claude remains fail-closed.