Track upstream ACP session injection dependencies #25

Kit uses published ACP fork crates while required steering and transport behavior converges upstream. Git pins and Cargo patches were already removed in #256. This remains a behavior-parity migration tracker, not a checklist of the original PR numbers.

Current upstream state (verified 2026-11-01)

• Insertion message-ID receipts shipped through feat(unstable-v2): return message ID on prompt insertion agentclientprotocol/agent-client-protocol#2175 and feat(acp): update schema dependency to 1.9.0 agentclientprotocol/rust-sdk#366.
• Steering/prompt-delivery design: docs(rfd): steer and queue prompts sent while the Agent is working agentclientprotocol/agent-client-protocol#1261 now proposes session/prompt delivery fields (steer/queue) and replaces the original injection-method design. It builds on docs(rfd): propose session steering agentclientprotocol/agent-client-protocol#2255. Both remain open.
• Original injection schema/SDK proposals feat(unstable-v2): add session injection schema agentclientprotocol/agent-client-protocol#2043 and feat(unstable-v2): add session injection support agentclientprotocol/rust-sdk#339 remain open, but their merge alone is not the migration acceptance criterion if the accepted wire design changes.
• feat(jsonrpc): add tracked response receipts agentclientprotocol/rust-sdk#338 was closed without merge as the v2 batching design changed. Do not interpret that as evidence that insertion receipts are absent. Insertion acknowledgments and response-transport enqueue receipts are different guarantees.
• Released upstream Rust SDK v3.6.0 pins schema =1.13.0; inspecting that release finds no equivalent session/inject binding or ResponseReceipt/respond_tracked API. A newer protocol schema release alone does not establish usable SDK parity.

Kit follow-up

• Replace git pins with released crates and remove temporary patches (chore(deps): use published ACP and agentkit forks instead of git pins #256).
• Resolve ACP/AgentKit packages to one source identity (chore(deps): use published ACP and agentkit forks instead of git pins #256).
• Compare the accepted upstream delivery contract against Kit's current steering, revoke/replace, cancellation, and response-ordering guarantees using real interoperability tests.
• Adapt Kit/AgentKit if upstream prompt-delivery fields replace the fork's injection methods; do not assume a Cargo-alias-only migration.
• Switch to a compatible released upstream SDK/schema/HTTP set once required behavior is supported.
• Re-pin macos/ACP/Schema together with the Rust migration and verify generated wire parity.

Current published fork dependencies

The forks preserve the upstream Rust library names. This simplifies dependency identity but does not remove the need to reconcile changed protocol semantics. Existing fork-backed functionality remains supported while this migration is pending.