Prototype retained CDP sessions in kernel-images-api

[sjmiller609]

Summary

Prototype the guest half of resumable CDP inside kernel-images-api, disabled unless a unique per-instance relay token is configured.

• Retain the original guest-local CDP connection through the existing proxy, preserving its telemetry and Chrome-restart behavior.
• Add versioned private HTTP operations for logical-session creation, ordered commands/events, acknowledgments, and fenced park/resume.
• Deduplicate retries without repeating Chrome commands; fail explicitly on lost state or overflow rather than reconstructing a session.
• Bound connections, queued output and pending commands. Expire abandoned active sessions, but never expire a parked session merely for transport silence.
• Reject inherited fork-template activation and conservatively prevent parking for nested CDP commands.

No OpenAPI generation, SDK, image build configuration, or default behavior changes.

Validation

• go test -race -count=10 ./lib/cdprelay — passed.
• go test ./cmd/config ./cmd/api ./lib/devtoolsproxy — passed.
• go vet ./lib/cdprelay and static API build — passed.
• Rebuilt guest API plus the paired metro transport passed two final automatic standby/restore cycles with the same Playwright connection, JSHandle, CDP IDs, binding subscription and breakpoint. No forced standby calls were used.
• Full repository suites were not run; checks were scoped to the affected packages and live transport boundary.

Rollout boundaries

This is a gated prototype, not a general rollout. Per-instance/fork key handoff, safe suspension eligibility, reusable-browser teardown, and sustained lifecycle/load validation remain. Parked orphans after host failure are bounded and survive until browser teardown. The previously observed snapshot filesystem stall is not resolved by this change.

Protocol and reproduction details: server/lib/cdprelay/README.md.