v0.6.8 - Agentic Phase 2: multi-call steps, approval gating, trace tooling

• Multi-call steps: one assistant turn may request several tools; the loop validates, approves, executes, and reinjects them in order with limits and cancellation checked between calls. All three protocols now parse every well-formed call per step.
• Approval gating: every tool declares a risk class (ReadOnly / LocalWrite / ExternalSideEffect). The default policy denies declared external effects as structured, traced, model-visible rejections; hosts embed custom gates via ApprovalPolicy::custom. CLI: --allow-unsafe-effects.
• Trace tooling:
  • ember trace diff - structural comparison of two runs (status, totals, final-answer digest, event-type skeleton with first divergence; --fail-on-diff for scripting)
  • ember trace replay - re-executes recorded deterministic tool calls offline against a fresh registry (no model loaded) and verifies stable payload digests
  • ember trace report - self-contained HTML report: summary card, timeline bars, artifacts, full event table; inline CSS only, no JavaScript
• Replay digests: every execution records payload_sha256 plus a rerun-stable replay_sha256 under all privacy modes.
• image_fixture built-in: deterministic PNG through the artifact path (image/png), proving binary media flows end-to-end.
• Docs: docs/agent-runtime.md; README gains an agentic section.

Also fixes the last platform-dependent serialization site in protocol renders (aarch64-only serde_json preserve_order flip) and adds a source-level regression guard.

Tests: 47 lib unit + 27 hermetic integration tests; replay verified against a live Qwen2.5-1.5B run (3/3 digests match).