Store immutable public responses and support owner-scoped retrieval

[ajac-zero]

Problem

The item ledger and continuation record do not preserve the exact terminal Open Responses object returned by an agent runtime. Reconstructing a response from ledger items can change fixed fields, ordering, IDs, error details, or usage and cannot guarantee retrieval parity with the original response.

Proposed change

Add an immutable stored-response record linked to the conversation turn and continuation. It should include at least:

• tenant ID and owner reference
• agent reference
• conversation and turn IDs
• response ID and optional previous response ID
• terminal status
• exact public response JSON
• canonical response digest and schema/version marker
• continuation sequence boundary
• created and terminal timestamps

Provide owner-scoped retrieval by response ID, either through a dedicated endpoint or an expanded continuation endpoint. Missing and wrong-owner IDs must be indistinguishable. Private continuation state must not be included in ordinary response retrieval.

Acceptance criteria

• Uniqueness includes tenant, owner, agent, and response ID.
• A terminal public response is immutable.
• Retrieval returns the exact validated stored object, not a reconstructed approximation.
• Response size and JSON/schema validation are bounded.
• Wrong-owner, wrong-agent, and absent lookups return the same public result.
• Existing continuation uniqueness is migrated to include owner scope where necessary.
• Migration, retrieval authorization, and malformed stored-data behavior are tested and documented.

Integration context

This enables GET /v1/responses/{response_id} in Bonsai and recovery when terminal delivery fails after Threadmark commits.

[dispatch-developer]

Triaged as hard: this spans immutable persistence and migration, owner-scoped authorization, a retrieval API, compatibility behavior, and comprehensive validation/testing.