Runtime sessions let agents control and inspect running apps

Fabrik run now supports --runtime-rpc to create a file-backed runtime session and expose a local JSON-RPC control socket. For runtime-aware command targets and Apple simulator apps, fabrik run emits a runtime descriptor that agents can use to discover logs, screenshots, UI trees, and available UI actions. A new fabrik runtime rpc <session-dir> command replays or debugs an existing session directory. Runnable targets can opt in by adding nested [target.runtime] metadata in their TOML configuration.