fix(agent,control): make interrupted turns recoverable without repeating side effects / 中断回合可恢复且不重复副作用

[SivanCola]

Turn reliability and interrupted-turn recovery: work that already happened is
never repeated, a result the host never saw is never invented, and every turn
ends in a durable terminal state.

Closes the core of #9825; also covers #9805, #9683, and the replay half of #9566.

Built on the existing turns.jsonl lifecycle ledger, session events,
InterruptedTurnRecovery, and the executeBatch executor. No parallel
persistence system is introduced.

Phase 1 — state correctness

• One toolOutcomeState classifier behind both the ledger event and the stored
  tool message, so the two can never disagree. Interruption evidence now wins
  over the executed flag; an explicit refusal still reads as never-run.
• Cancellation classifies each remaining call by the durable tool_started
  barrier: started calls become unknown, the rest cancelled.
• An unknown outcome engages the batch mutation barrier, so later writers are
  skipped while read-only diagnosis still runs.
• Explicit failures get their own failed_tools bucket instead of being demoted
  into the bucket that forbids retrying.
• Cancellation with an unproven side effect, or a turn that died before
  producing anything, ends as recovery_required rather than interrupted.
• Every provider request passes a final transcript gate on the same normalized
  view the adapters send ([Bug]: Truncated assistant turn with unterminated tool_calls is replayed verbatim, causing 400 on strict OpenAI-compatible backends (MiMo) / 截断响应携带未闭合 tool_calls 原样回传，严格后端（MiMo）400 #9566).

Phase 2 — persistence and recovery

• Reopening a ledger whose turn never terminated answers each unanswered call
  from its persisted start barrier, tags the synthesized results with a reopen
  source so a second reopen reads the same evidence, and escalates the recovered
  turn when an effect is unproven. The results still carry no arguments or output.
• The controller threads that evidence into the dead turn's tail strip, naming
  the cause runtime_restart and marking a turn that produced nothing as silent.
• The first side-effecting call of a turn stamps its checkpoint with the turn ID,
  call ID, argument digest, and transcript digest.
• TurnDone carries Recovery on the wire, so Desktop can actually see the
  recovery_required state Phase 1 introduced.

Phase 3a — resolving an unproven effect

• A user who inspected the workspace can attest that an unknown call already
  happened. Recorded with provenance under a distinct
  completed_by_user_confirmation state — never plain completed, because the
  host never saw the result — with no fabricated tool result. Refused for calls
  the host already proved and while a turn is running.
• Bug found while testing: loading a session backfills a placeholder result
  for every unanswered call, and recovery read that placeholder as a genuine
  unknown outcome. That silently bypassed the ledger evidence on exactly the
  path that needs it — a real restart. Placeholders are now distinguishable, so
  proof wins.
• Desktop history gains structured interruption-card data carrying each call's
  proven state plus its local argument receipt, which is what makes a long
  edit_file/write_file inspectable by hand. Those arguments are display state
  only and never enter the model-facing block.
• A regression test locks in that ordinary tool interruption never forks a
  session; forking stays reserved for a genuine cross-process file conflict.

Not in this PR

The recovery card UI itself, the read-only "inspect workspace" action, and
"re-run tool" (new attempt ID, original call ID never reused). Re-run adds a new
execution path outside a model turn and is worth landing on its own.

The Wails App binding for the confirmation deliberately lands with that UI
rather than here: an unconsumed binding would grow bridge.ts past its repolint
ratchet and the raw bundle ceiling for no user-visible gain. The controller API
and the card projection are here and tested, so the UI change stays small.

Verification

go test ./internal/... and the desktop module, golangci-lint v2.12.2 (0
issues), go run ./tools/repolint clean, gofmt, go vet, tsc --noEmit.

Cache-impact: low - the model-facing recovery block gains failed_tools, user_confirmed_effects_do_not_repeat, cause and silent_interruption lines plus one sentence of guidance. It is appended to the mutable user-turn tail, never the cached system-prompt prefix; tool schemas, base prompt and memory block are untouched.
Cache-guard: go test ./internal/agent/ -run 'InterruptedRecoveryBlock|ConfirmedEffects|SamplingGate|ReplayRecovery' asserts the block's exact contents, that arguments never enter it, and that the provider request view is unchanged for healthy turns.
Documentation-impact: updated - docs/TURN_RELIABILITY.md and docs/TURN_RELIABILITY.zh-CN.md document tool run states, batch rules, the recovery handoff, restart recovery, checkpoint identity, resolution, terminal status and the transcript gate; CHANGELOG has Unreleased/Fixed entries.