Make tool history projection deterministic

What's Changed

• Project Codex, Claude, and ACP tool events into one typed canonical presentation instead of parsing provider prose in history and the browser.
• Bound streamed tool output with reusable head-tail ring buffers, split-safe ANSI filtering, explicit omission counts, and immediate terminal-state cleanup.
• Stop retaining raw provider payload strings and render semantic subjects, paths, outcomes, failures, and bounded evidence consistently across history, recovery, screen logs, and the web UI.

Release integrity

Native archives have matching platform-specific SPDX SBOM assets plus GitHub build-provenance and SBOM attestations. Installers and the built-in updater additionally verify a signed manifest and all packaged-file hashes.

Verification guide · Security policy