Enforce the hard context limit on the full request, with turn rollback

[lavindeep]

Problem

The context-budget estimate that drives compaction and the hard-limit refusal
only counted the system prompt and history. It ignored the encoded tool
schemas and tool-call arguments — roughly a couple thousand tokens on a
default toolset — so a request that looked under the limit on paper could
still overrun once everything was serialized to the model. There was also no
in-loop guard: a turn that only crossed the limit after several tool results
accumulated was sent anyway, and a refused turn could leave a stuck user
message (or an orphaned assistant tool_call) in history and on --resume.

Change

• Full-request estimate. estimated_prompt_tokens() now includes the live
  profile's encoded tool schemas (tool_schema_tokens) and per-message
  tool-call arguments, closing the undercount. run_command results are held
  to the command prompt cap.
• Gate before every model call. The pre-turn gate and a new in-loop gate
  both check the full request against hard_limit_tokens. With automatic
  compaction on, the runtime compacts first and refuses only when compaction
  cannot recover; with it off, it refuses directly.
• Turn rollback. A refused pre-turn request discards the just-recorded user
  message (discard_last_message reconciliation record) so --resume does not
  restore a stuck user turn with no reply. A mid-loop overrun rolls the
  in-flight assistant turn back (last assistant message to end of history,
  truncate_last_turn) so no orphaned tool_call is re-sent.
• Last-resort recovery (auto_compact only). When an in-flight tool result is
  large enough to overrun on its own inside the tool loop, the runtime
  force-digests every tool result — including the normally protected recent
  window — and retries once before refusing. This is a bounded, documented
  exception to the protected-tail compaction invariant, gated behind
  auto_compact; with compaction off the protected tail is never rewritten.

Behavior change

Turns that would exceed the hard context limit are now refused deterministically
before the model is called (previously such a request could still be sent).
On refusal the user sees a guidance status message, the offending turn is rolled
back out of history and the session transcript, and the session stays usable
rather than being pinned over budget. This applies whether automatic compaction
is on or off.

Docs

docs/DESIGN.md updated in step: the budget section now describes tool-schema
counting and compaction-on/off refusal; §20.2 documents the bounded
force-digest recovery exception; the Session-resume row documents the new
discard_last_message reconciliation record.

Testing

Full local phase gate green at HEAD:

• ruff check . — passed
• ruff format --check . — clean (146 files)
• mypy shellpilot --strict — Success, 83 source files
• pytest — 1632 passed

New coverage includes: schemas + tool-call args in the estimate; explicit
context setting not capped; refusal when compaction cannot recover; refusal
discarding the recorded user message; mid-loop rollback of the in-flight turn;
mid-loop refusal with auto_compact off not digesting the protected tail;
discard_last_message load semantics; and run_command honoring the command
prompt cap.