Add manual ACP session rotation command

[tlongwell-block]

Summary

• add an owner/mention-gated !rotate control command to the sprout-acp harness
• generalize in-flight task control from cancel-only to typed control signals so rotation can reuse the shutdown/cancel path
• invalidate idle channel sessions immediately, or cancel the in-flight turn and invalidate once it returns
• document the new command in the sprout-acp README

Verification

• cargo test -p sprout-acp
• git show --stat --check HEAD

Notes

• Initial plain git push ran repo pre-push hooks and hit an existing/unrelated desktop Rust compatibility error in desktop/src-tauri/src/commands/agent_discovery.rs for unstable str::floor_char_boundary. This change only touches crates/sprout-acp and the focused sprout-acp tests pass.

[tlongwell-block]

Reviewed at merge head f4ea8fc. Verified locally: cargo fmt --check, clippy -p buzz-acp --all-targets -D warnings, cargo test -p buzz-acp (288 pass) — all green in a clean worktree.

The design is right: generalizing CancelMode → ControlSignal and reusing the cancel path for rotation is the minimal way to do this. The is_owner_control_command extraction de-triplicates the shutdown/cancel/rotate checks nicely. README distinction between !cancel and !rotate is accurate.

One correctness gap — rotate intent can be silently dropped in the Race 1 window (pool.rs ~L1122):

When !rotate arrives while a turn is in-flight but the turn completes naturally just before the signal lands (has_in_flight_prompt() is false), the else-branch sends PromptOutcome::Ok without invalidating the session. The main loop's fired=true path also skips invalidate_channel_sessions. Net: the owner explicitly asked for a fresh session, the harness logged "rotating", and the next turn reuses the old session anyway.

For !cancel this race resolution is correct — nothing left to cancel. For !rotate the intent isn't "stop the turn", it's "next turn gets a fresh session", and that intent survives the turn finishing. Suggested ~3-line fix in the else branch:

if control_signal == ControlSignal::Rotate {
    agent.state.invalidate(&source);
}

This is also the one place ControlSignal::Rotate must differ from Cancel — right now every match arm treats them identically (Cancel | Rotate => None), so the variant is purely informational. The fix makes it load-bearing.

Same-shaped (rarer) edge: if control_tx was already consumed by a prior signal, fired=false → the idle-invalidation fallback runs while the agent is checked out, so invalidate_channel_sessions misses it. Could be handled by tracking a pending-rotate per channel, but that's heavier machinery; probably fine to note and skip.

Narrow windows, non-corrupting (worst case: one stale-context turn after rotate), so not blocking — but the 3-line fix is cheap and closes the main one.

Nit: is_owner_control_command doesn't actually check ownership — that stays at the call site (consistent with prior code, but the name overpromises slightly).