Add OpenSessions workflow trace sink

[andrei-hasna]

Summary

• add an OpenSessions trace sink for workflow runs, with opt-in package-backed @hasna/sessions persistence via OPENLOOPS_OPENSESSIONS_TRACE=1
• emit redacted workflow/step/process/agent progress/terminal trace entries and expose the trace replay command from workflows inspect
• document OpenSessions trace usage and keep OpenLoops events/Todos comments as the orchestration/task sources of truth

Validation

• TMPDIR=/tmp/codewith-bun-tmp TMP=/tmp/codewith-bun-tmp TEMP=/tmp/codewith-bun-tmp BUN_INSTALL_CACHE_DIR=/tmp/codewith-bun-cache bun run typecheck
• TMPDIR=/tmp/codewith-bun-tmp TMP=/tmp/codewith-bun-tmp TEMP=/tmp/codewith-bun-tmp BUN_INSTALL_CACHE_DIR=/tmp/codewith-bun-cache bun test
• TMPDIR=/tmp/codewith-bun-tmp TMP=/tmp/codewith-bun-tmp TEMP=/tmp/codewith-bun-tmp BUN_INSTALL_CACHE_DIR=/tmp/codewith-bun-cache bun run test:boundary
• package-backed smoke with temporary HASNA_SESSIONS_DB_PATH: workflows inspect exposed openSessionsTrace.sessionId and the OpenSessions DB row had ended_at, duration_seconds, 5 messages, and 1 tool call

Adversarial Review

• reviewer found package-backed sessions were not marked ended; fixed by passing terminal workflow context to the writer and updating duration_seconds on upsert
• added regression coverage for package-backed terminal trace metadata

Notes

• tracing is opt-in for the package-backed writer to avoid ordinary local/test runs writing to an operator sessions DB; SDK callers can inject a trace sink directly
• hidden reasoning, prompts, env values, credential-like fields, shell commands, and raw output are redacted or bounded before trace persistence