feat(cli): add OpenCode-compatible session undo and redo

[limityan]

Summary

• Add the OpenCode-compatible /undo and /redo commands to Embedded and Shared TUI, with no aliases or custom keybindings.
• Restore the user prompt to the composer, support repeated undo/redo, and rebuild the TUI from the Runtime-owned authoritative transcript.
• Keep transcript, model context, usage, fork, snapshot, export, and passive consumers on one staged Session-history boundary.
• Quiesce active work through the scheduler, persist crash-recoverable transition phases, and permanently commit the hidden suffix before a new prompt or conflicting snapshot mutation.
• Fail closed for Remote workspaces; this PR does not add Relay server/protocol functionality.

Architecture

• Session-history policy and durable recovery stay in Core; the Agent Runtime exposes only narrow typed revert operations.
• Workspace restore remains owned by the snapshot subsystem, while scheduler maintenance and keyed Session mutation serialize all history readers/writers.
• View-only auto-restore and boundary-zero staged-marker rejection are covered as independent execution-binding contracts, so durable-history safety does not depend on workspace locator test setup.
• SessionHistoryChanged is a stable invalidation fact for cached projections instead of leaking /undo or /redo semantics into adapters.
• Desktop, CLI, Remote Control, Bot, Insights, AI Memory, transcript export, and account sync consume marker-aware owner APIs. Pending account-history imports are never uploaded as empty or partial replacements.
• Shared TUI uses the existing bounded private IPC and current-controller rules; no public checkpoint API or second Core owner is introduced.

Verification

Final branch base: main@26370da3.

• cargo check --workspace --quiet
• cargo test --quiet -p bitfun-core --lib - 1701 passed, 1 ignored after the CI hardening fix; post-final-rebase execution-binding suite 3/3 passed
• cargo test --quiet -p bitfun-cli - 502 unit tests plus integration suites passed before the final no-conflict rebase; post-rebase /undo contract passed
• cargo test --quiet -p bitfun-desktop - 208/208 passed before the final no-conflict rebase; post-rebase owner-wiring contract passed
• Runtime ports, events, Agent Runtime, and IPC suites passed
• Remote Connect unit suite 87/87 passed; history invalidation and outcome-unknown regressions passed
• node scripts/check-core-boundaries.mjs
• boundary checker self-test

The broader Services Integrations test surface still has two unchanged-main issues outside this diff: the all-feature plugin_source test lacks a native_path_identity import, and remote_chat_history_assembly_skips_in_progress_assistant_history expects one message while the unchanged projection returns two.

Earlier frontend verification on main@cb444fa5:

• Dispatch observer suite: 17/17 passed
• pnpm run lint:web: passed with one upstream Dispatch warning and no errors
• pnpm run type-check:web: passed
• Full Web UI run: 367/368 files and 2473/2474 tests passed locally; the sole Windows-only contract failure hard-codes LF while this checkout uses CRLF, and is outside this diff

The final combined head is validated by the PR checks below.