fix: DGR-033 repair native worker protocol per cross-review BLOCK

Address the Codex GPT-5.5 review of the standalone fake C++ gRPC Shard
worker. Four root protocol defects fixed:

- Fail closed before SessionOpen: a per-session `opened` flag gates
  chunk/decode so no activation bypasses lifecycle, cancellation, epoch
  or flow-control state (terminal ERROR_CODE_INTERNAL), even when an
  out-of-band Cancel created placeholder state.
- Strict flow-control negotiation: NegotiateFlow takes the strictest of
  peer-vs-worker bounds (mirrors codec.negotiate_flow_control) and the
  negotiated per-session max_chunk_bytes is enforced on every bundle
  instead of trusting the peer proposal.
- In-stream ReleaseSignal now erases session state immediately.
- SessionOpen rejects incompatible schema, fingerprint, and shard-range
  identity and reports the worker's own served fingerprint rather than
  echoing the caller.

Adds 9 regression tests (worker suite 18 -> 27). Real gates on the
rebuilt pinned-gRPC binary: cmake build exit 0; ctest 2/2; worker
pytest 27 passed; harness+protocol 63 passed; compileall 0; diff --check
clean; ldd/nm show 0 llama/ggml linkage. DGR-033 passes -> true.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

packages/node/native/worker/shard_service.h

@@ -42,15 +42,20 @@ struct SessionState {
   int64_t credits = 0;
   uint32_t max_inflight = 0;
   uint64_t max_chunk_bytes = 0;
+  uint32_t max_prefill_chunk_tokens = 0;
   std::set<uint64_t> seen_steps;
   std::set<std::string> cancelled_work;
   bool cancelled_session = false;
+  // True only after a valid SessionOpen handshake completed for this
+  // route_session_id. An activation (chunk/decode) that arrives while this is
+  // false fails closed: no work may bypass the lifecycle handshake, even when a
+  // placeholder state already exists from an out-of-band Cancel that raced Open.
+  bool opened = false;
 };
 
 class ShardRuntimeServiceImpl final : public sp::ShardRuntime::Service {
  public:
-  explicit ShardRuntimeServiceImpl(FlowLimits limits)
-      : limits_(limits), engine_(limits.max_chunk_bytes) {}
+  explicit ShardRuntimeServiceImpl(FlowLimits limits) : limits_(limits) {}
 
   grpc::Status GetCapability(grpc::ServerContext* context,
                              const sp::CapabilityRequest* request,
@@ -74,6 +79,12 @@ class ShardRuntimeServiceImpl final : public sp::ShardRuntime::Service {
   // if the Cancel raced ahead of SessionOpen.
   uint32_t MarkCancelled(const std::string& route_session_id, const std::string& work_id);
 
+  // Settle a stream's flow-control window against this worker's own limits: the
+  // strictest bound of either peer wins for every field, so a peer can never
+  // raise the worker's ceilings by proposing a larger window. Mirrors
+  // `negotiate_flow_control` in `native_protocol/codec.py`.
+  FlowLimits NegotiateFlow(const sp::FlowControl& proposed) const;
+
   FlowLimits limits_;
   FakeShardEngine engine_;
   std::mutex sessions_mu_;