Add telemetry for durable session restore and session management - #757

Summary

The intelligent-features telemetry catalog covers prompts, turns, cold starts, slash commands, MCP calls and hooks — but the durable-session chain (save → restart → restore → ACP session/load) has no instrumentation on any hop, and the session view reports only two of its four outcomes. This fills both gaps, following the conventions already established in TelemetryEvents.md: same providers, same MICROSOFT_KEYWORD_MEASURES, same privacy tags, same controlled agent set, catalog updated alongside.

The resume funnel

Four events, one per hop, so a drop-off can be attributed rather than guessed at:

The gap between AgentPaneRestoreCompleted and AgentPaneResumeStarted is the C++ → WTA handoff loss, which neither side can see alone.

AcpLoadSessionComplete splits ResourceNotFound out of AcpError. That is the error behind the user-visible "Failed to resume session ... Resource not found" — the failure a stale persisted session id produces. Folded into a generic bucket it is invisible. Classification goes through the existing AgentFailure::from_acp_error, so it tracks ACP error codes rather than message text, and Route (Restore / SessionView) separates a layout restore from a session-view resume — the two have very different latency profiles.

Session management

SessionResumeInvoked covered ResumeInAgentPane and ResumeCliFlag and explicitly skipped the other two branches, which measured the happy path alone. It now covers all four, and carries NotResumableReason — LiveWithoutPane, LoadSessionNotSupported, CliHasNoResumeFlag, UnknownCli. Those four are exactly the dead ends a user runs into, and decide_enter_action is a closed pure function, so the set cannot drift.

Reporting stays on the dispatch side; the session_mgmt decision boundary is untouched.

Also added

• SessionResumeAbandoned — one Reason per lifecycle event (AgentRebind, NewSession, ResetAgent, MasterRestart, PaneClosed) rather than a generic failure, since they are indistinguishable to the user: the pane says "Resuming session ..." and then quietly comes back as a cold start. Gated on loading_session, so the resets that run with no resume pending report nothing.
• AgentSessionBindingChanged — a shell pane that never binds an agent session can never persist a resume command line, so this is the upstream gate on every shell-pane restore, and it was failing silently.
• AgentShellPaneResumed — carries BufferRestoreSuppressed, which must always be true; a resumed pane''s scrollback is deliberately not seeded because the CLI replays its own transcript.
• AgentPanePrewarmAfterStartup — Deferred must equal Prewarmed + Skipped + failures; a mismatch is the "tab ends up with two agent panes, or none" bug class.
• FirstWindowPreference on IntelligentFeatureConfigured — the whole feature rides the saved window layout and is inert unless this is persistedLayout or persistedLayoutAndContent. Without it there is no denominator to read restore rates against. Uses the existing emitIntelligentFeatureConfigured helper.

AgentLayoutSaved is suppressed when a window has no agent state. Every save path funnels through GetWindowLayout, including the five-minute crash-protection timer, so an unconditional event would mostly be windows that have never opened an agent pane.

Privacy

No session id, command line, working directory, session title, or prompt text is reported; all new C++ fields are counts and closed enums. Agent names go through the same controlled set as the rest — including the hook-reported ones at AgentSessionBindingChanged, which arrive from outside Terminal and are bucketed to custom (or unknown when absent) rather than reported verbatim.

Non-goals

LoadSessionRoute is telemetry-only and never used for routing; the restore and session-view paths stay deliberately identical past the point it is recorded. The GPO check behind AgentPaneRestoreCompleted.Result = BlockedByPolicy only observes the decision — the gate that enforces it remains in _AutoCreateHiddenAgentPaneShared.

Validation

• cargo test --target x86_64-pc-windows-msvc --manifest-path tools/wta/Cargo.toml → 1872 passed, 0 failed, 1 ignored, including the new load_session_failure_fields_separates_resource_not_found, which pins each ACP error code to its bucket.
• cargo fmt clean; cargo clippy --all-targets surfaces nothing new (the one unused import: CliSource warning is pre-existing on main in an untouched file).
• cmd.exe /c "tools\razzle.cmd && bcz no_clean" → 0 errors, re-verified after clang-format.