#3457 refactor(daemon): extract appstate Apple-session and device-runtime responses

Summary

Part of #3424 (CRAP burn-down, umbrella #3414). Layer 3 of 4; stacks on #3456 (shutdown extraction).

Extracts the two leaf response paths of handleAppStateCommand into:

• session-appstate-apple-session.ts — respondAppleAppStateSession (Apple session snapshot/refresh, stale-session retry loop). Per R75 (handler-owned SessionState membership ratchet) this module takes a structural AppStateSessionRecord view instead of importing SessionState; the adapter lives beside the dispatcher.
• session-appstate-device-runtime.ts — queryAppStateDeviceRuntime (non-session device-runtime query).

Both new modules use installRuntimeGatewayFromContext (R80 pattern). No behavior change.

• handleAppStateCommand: 31 → 21 at this layer; 5.0 at stack top. This layer removes the check:coverage-crap --all finding for the Apple-session/device-runtime branches; the admission branch resolves in layer 4.
• New tests mirror source one-to-one: session-appstate-apple-session.test.ts, session-appstate-device-runtime.test.ts.

Part of the stacked split of session-state.ts for #3424 (umbrella #3414).

Validation

• pnpm check:affected --run on this head: all runnable checks passed (2026-10-12).
• pnpm check:coverage-crap --all: no function ≥ 30 except the admission branch of handleAppStateCommand, resolved by layer 4.
• pnpm check:layering: pass; both modules registered in daemon-layer-manifest.json (daemon-sessions).

_{Created by Apex.}