feat(canvas): add targeted design revisions

[beruro]

Problem

Canvas follow-up edits currently require the agent to regenerate and resend the full Canvas source before useful progress appears. Even small copy changes can therefore take minutes, the UI does not preserve a clear logical relationship between the original Canvas and its revision, and narrow chat rows can overflow while revision activity is rendered.

Solution

Add a complete targeted Canvas revision lifecycle:

• select an element or region in the existing Canvas and submit bounded context through the shared compact InputArea;
• register revise_inline_canvas with a required same-session target_event_id;
• prefer bounded exact edits for localized changes while retaining complete replacement payloads for structural changes;
• keep immutable tool events authoritative and project the latest valid materialized version into one logical Canvas;
• coalesce receiving/applying progress to at most 20 Hz while retaining the last valid Canvas;
• persist 1–6 request-specific agent steps and derive completion/failure from the real tool lifecycle;
• clear transient revision state on completion, failure, cancellation, reset, and session deletion;
• reuse shared event headers, pills, composer shells, replay navigation, and contained/truncated narrow-row presentation.

The latest develop conflict resolution preserves the current always-available mode control in the normal composer while hiding mode/model controls only in the contextual compact Canvas composer.

Potential risks

This spans the Rust tool contract, persisted event projection, streaming state, DOM selection, and shared composer presentation. Revision ancestry is bounded to 32 events; malformed or stale patches retain the last valid Canvas rather than applying partial content. Agent-step metadata is bounded to six labels of 80 characters; malformed metadata is rejected for new calls and omitted defensively for legacy replay. No schema migration or persistence-format rewrite is introduced, so rollback is a normal revert of the three feature commits.

The remaining review gap is rendered desktop verification: the isolated browser cannot initialize the required Tauri sidecar, so a current Tauri recording covering selection, compact submission, streaming progress, completion navigation, failure, and cancellation is still required. The PR remains Draft for that reason.

Audit

• Architecture: covered compilation, call chain, naming, ownership, default branches, domain boundaries, serialization, registration parity, and target-resolution symmetry. Persisted tool events remain authoritative; the Jotai draft is transient progress only.
• Frontend UI: the checked-in reports cover the contextual composer, revision activity, and progress presentation. Shared controls and event primitives are retained rather than duplicated.
• Lifecycle/performance: no polling or persistent per-token write was added. A single trailing timer per store coalesces updates at 50 ms; terminal, reset, and session-deletion paths evict transient state.
• Effects: one retained Canvas inspector Effect synchronizes DOM listeners, ResizeObserver, and requestAnimationFrame; cleanup removes listeners, disconnects the observer, and cancels the frame.

Verification

Completed on the published head 4ea58aa0e, rebased onto develop at 9a2d6f6cf:

• test_files=(${(f)"$(git diff --name-only origin/develop...HEAD | rg '(test|spec)\\.(ts|tsx)$')"}); PATH=../../../node_modules/.bin:$PATH vitest run "${test_files[@]}" — passed, 24 files / 117 tests.
• cargo test -p core_types tool_names --lib — passed, 2/2 tests.
• cargo test -p agent_core ui_metadata --lib — passed, 13/13 tests.
• PATH=../../../node_modules/.bin:$PATH tsc --noEmit — passed after the current-base rebase.
• git diff --check and conflict-marker scan — passed.
• Final diff inspection — 81 files, all mapping to the Canvas revision lifecycle, its direct tests, localization, and required audit reports; no secrets, personal paths, build artifacts, or debug output found.

Not completed:

• Current rendered Tauri recording, for the sidecar limitation described above.
• Full frontend and Rust CI are running on the published head. Local full typecheck passed; full strict Clippy remains dependent on the independent develop baseline fix in fix(history): satisfy imported window clippy #752.