refactor(app): hold the session lock inside _run_impl directly

Drop the _run_locked split: _run_impl wraps its whole body in the session
lock, so step 7 keeps its original indentation and the diff against main
stays small.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: DavdGao