docs: add cart session persistence guidance

[hemanth]

Closes #344

Summary

Adds a non-normative implementation guidance document for cart session persistence, covering TTL recommendations, session resumption patterns, expiry handling, and agent reconnection scenarios.

Changes

• docs/guides/cart-session-guidance.md: New guidance document

Key guidance points

• Recommended TTL ranges by use case (food ordering: 15-30min, retail: 1-24hr, B2B: 1-7 days)
• Cart ID as transport-agnostic resumption handle
• cart_expired error code instead of generic 404
• Agent-specific reconnection patterns

This is intentionally non-normative — it captures recommended patterns without mandating implementation details.

[damaz91]

Hello @hemanth ! My 2cs on the cart persistence guidance is that these should pertain to each individual platform supporting the cart capability; I don't think UCP should prescribe any TTL.

We already have a section in https://ucp.dev/latest/specification/cart-rest/ talking about how to handle cart expiration (https://ucp.dev/latest/specification/cart-rest/#business-outcomes) and the "expires_at" field is already part of the output schema (https://ucp.dev/latest/specification/cart-rest/#output-schema_1).

Overall I don't see why these guidances should live in a different page rather then https://ucp.dev/latest/specification/cart-rest/

[hemanth]

@damaz91 fair points all around. You are right that UCP should not prescribe TTLs and that the existing expires_at field already covers the basics.

I have reworked the branch. The changes are:

1. Dropped the separate guide file. The content now lives inline in cart-rest.md as a "Session Persistence" section, right before Security Considerations.
2. Dropped the TTL table entirely. That is a platform-level decision, not something UCP should recommend.
3. Kept the parts that add value beyond what is already documented:
   • cart_expired as a distinct error code from not_found so platforms can tell the difference between "expired" and "never existed"
   • Cross-transport resumption (cart created via MCP should be retrievable via REST)
   • Agent reconnection patterns for voice/chat scenarios

The whole section is marked non-normative.

Let me know if this works better or if you think any of the remaining guidance is still too prescriptive.