[codex] add controlled state lifecycles

[nahiyankhan]

Summary

Adds the remaining small controlled-state surfaces on top of prepared approval actions:

• opt-in controlled action lifecycle state via controlled: true with pending/done/error keys
• optional resource empty state via stateKeys.empty and isEmpty(data)
• runtime/validator support so generated surfaces can render merchant-facing pending, error, success, and no-results states from host-owned truth
• gallery and docs updates showing the intended usage

Validation

• pnpm --filter @summon-internal/host test
• pnpm --filter @summon-internal/engine test
• pnpm --filter @summon-internal/host typecheck
• pnpm --filter @summon-internal/engine typecheck
• pnpm --filter @summon-internal/sandbox-runtime typecheck
• pnpm --filter @summon-example/surface-gallery typecheck
• pnpm --filter @summon-example/surface-gallery test
• pnpm --filter @summon-example/surface-gallery test:e2e
• pnpm --filter @anarchitecture/summon typecheck
• pnpm check:public-api
• git diff --check

Notes

Approval actions remain separate: this keeps ApprovalPrepared, ApprovalRequest, ApprovalStateKeys, and ctx.approval.plan as the approval-specific controlled workflow.