feat(tokens): unify counting via ports.Tokenizer port

CHANGELOG.md

@@ -7,8 +7,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+
+- **F094**: Unified token counting via `ports.Tokenizer` port — all CLI-based agent providers (Claude, Gemini, Codex, GitHub Copilot, OpenCode) now count tokens through an injected `Tokenizer` interface instead of inline `len(output)/4` helpers; default `ApproximationTokenizer` preserves identical behavior; eliminates mutation side-effect on shared conversation turn state during input token estimation; dead `estimateTokens`/`estimateInputTokens` helpers removed; enables future swap to real token counting (e.g., tiktoken, stream-extracted counts) by changing a single injection point
+
 ## [0.8.1] - 2026-05-11
 
+- **F093**: Add dangerously_skip_permissions alias for --allow-all for Github Copilot agent
+
 ## [0.8.0] - 2026-05-09
 
 ### Fixed

CLAUDE.md

@@ -243,7 +243,6 @@ func TestWorkflowValidation(t *testing.T) {
 
 ## Common Pitfalls
 
-- When removing redundant infrastructure code, document the architectural ownership pattern; explain which layer assumed responsibility and why the field was removed
 - Always apply code deletions before writing tests that validate the deletion effect; tests may pass against overridden behavior instead of the intended code path
 - Wrap YAML/JSON mapping errors (duration parse, type conversion) in domain error types; surface failures immediately to prevent silent defaults
 - Never merge infrastructure provider stubs; always implement ExecuteConversation fully or return NotImplementedError with linked tracking issue
@@ -284,6 +283,7 @@ func TestWorkflowValidation(t *testing.T) {
 - Never silently initialize nested struct fields during YAML unmarshaling; explicitly map all sections (events, metadata, etc.) to prevent zero values from hiding parsing bugs
 - Always stage all modified implementation files and run 'git status' before marking task complete; unstaged files indicate incomplete task closure.
 - Update plan task status immediately when implementation completes; regenerate validation report to catch status-code mismatches before submission.
+- Always replicate nolint:errcheck directives identically across all provider implementations; verify explanatory comments match before make lint
 
 ## Test Conventions
 

docs/development/architecture.md

@@ -207,7 +207,7 @@ Implements domain ports with concrete technologies.
 - `pluginmgr/` - Plugin lifecycle (manifest, state, gRPC connections); delegates transport to `pkg/registry/`
 - `repository/` - YAML file loader implementing `Repository`
 - `store/` - JSON state store implementing `StateStore`, SQLite history storage
-- `tokenizer/` - Token counting for conversation context management
+- `tokenizer/` - Token counting implementations (`ApproximationTokenizer`, `TiktokenTokenizer`) implementing `ports.Tokenizer`; injected into `baseCLIProvider` for unified token counting across all CLI agent providers
 - `xdg/` - XDG directory discovery
 
 **Shared Packages (`pkg/`):**