fix(session): surface a refused turn to the user instead of silence

[alpibrupa]

Summary

• run_turn_streaming_with_provider builds a refusal (log-append failure, undecodable history, or cache/trail divergence) as a TurnResult the caller has to inspect — but tui/main.lex's run_once/repl discard the returned TurnResult by design, to avoid double-printing a normal turn's already-streamed answer. A refused turn therefore printed nothing at all: no error, no explanation, just the process exiting with null.
• Found live while dogfooding a new package build: a one-shot task string containing an em-dash triggered exactly this. lex-schema's json_value parser collapses non-ASCII bytes to ? (a documented, deliberate tradeoff over there — see lex-schema#31/feat(permissions): collapse per-mode tool policy into single source of truth + wire permission gate #18, not a new bug), which desynced the trail-derived history from the in-memory cache and refused the turn silently.
• run_turn_streaming_with_provider now routes every refusal through on_step via a new refused_turn_streamed helper, instead of leaving it as inert return data.
• Because print_step intentionally prints nothing for StepDone (the text is normally already on screen from streaming TextChunks during a normal turn), refused_turn_streamed also emits the reason as a StepDelta(TextChunk(...)) first — the one channel print_step actually renders — before the terminal StepDone.

Fixes #134

Test plan

• lex check src/server/session.lex, plus a full repo sweep (lex check over every tracked src/ file)
• lex fmt --check src/
• lex test (4/4 passing)
• lex doc-sync --check
• Live repro before/after: the em-dash task above printed only null before this fix; after, it prints [refused: cached messages diverge from the trail-derived history]
• Verified no regression on the normal path: a plain-ASCII one-shot task still streams its answer exactly once, no duplicate output from the StepDone path

🤖 Generated with Claude Code