[EugeneTheDev]

Summary

When a v1 client sends session/cancel, it MUST answer every pending session/request_permission of that session with the cancelled outcome (docs/protocol/v1/prompt-turn.mdx). The v1 client runtime didn't: a pending request was released only if the agent sent the optional $/cancel_request, so the app had to track and answer its own requests next to every cancel(). close() had the same gap in both runtimes. The v2 runtime already handled cancel; this brings v1 in line and covers close in both.

Fixes

• New internal PendingPermissionCancellation holds one cancel signal per session and races each permission handler against it. The race is the only answering path, so each request gets exactly one response. The app's handler is cancelled, and the cancelled reply goes out once it has finished.
• cancel() (v1) completes the signal in a finally, so a failed session/cancel send still releases pending requests. Requests arriving after it and before the next turn are answered cancelled without reaching the app. v1 prompt() resets the signal only after its active-prompt check passes, so a rejected concurrent prompt can't undo a cancel.
• close() (v1 and v2) completes the signal before sending session/close. Otherwise an agent whose close waits for its turn would deadlock with a client waiting for the close response. A closed session stays cancelled through a CLOSED sentinel that no later turn replaces. A failed close still propagates its error; the holder (v1) and onClosed() (v2) still wait for a successful response.
• v2 now uses the same helper; its cancel() behaviour is unchanged.
• KDoc for cancel(), close() and both permission handler methods describes the new behaviour, including that handlers must respond to cancellation promptly. AGENTS.md gains a lifecycle rule.
• No public API change; acp/api/acp.api is unchanged.

Relation to #155

Independent and can merge in either order. With this change, an agent whose cooperative AgentSession.cancel() waits for its turn receives the client's cancelled answer instead of waiting for the user. Expect a trivial AGENTS.md conflict in the lifecycle list; keep both bullets.

Verification

• New v1 client tests (ClientPermissionCancellationTest), v2 close tests in client/v2/ClientSessionTest, and a cross-transport test in SimpleAgentTest (STDIO and WebSocket). Against the pre-fix runtime, the v1 tests (apart from the control) and the integration test fail.
• ./gradlew :acp:apiCheck and ./gradlew check pass.