fix(compaction): persist handoffs without internal filesystem access

[akemmanuel]

Summary

Refs #150; foundational dependent work for #151 and #155. Restricted compaction no longer asks normal Project tools to write/read internal temporary files.

• Ask for one bounded, structured, tool-free summary and persist validated text in the existing completed-compaction SQLite entry (payload.handoff). No new store, schema migration, filesystem grant, or internal-path exception.
• Inject durable historical summary text into continuation context, including legacy prose summaries; no normal tool access to handoff directories is required.
• Reject empty, malformed, oversized, incomplete/truncated, or tool-calling summary responses before publishing completion. Revalidate policy/cancellation before publishing.
• Keep internal compaction deltas out of task output while retaining separately attributed provider response/usage metadata.
• Preserve original history if a completed entry has no usable summary; exclude legacy failed-compaction artifacts from task model context.

Reproduction

The original deterministic Harness fixture followed the old handoff instruction using a restricted Project-only policy. Manual/threshold compaction denied the internal write and failed with missing HANDOFF.md. The same restriction now compacts and continues without any internal filesystem effect or permission widening.

Parent review added regressions for rendered-summary bounds, corrupt-summary history preservation, failed legacy artifact replay, incomplete/truncated responses, and provider usage preservation. All were independently verified after review corrections.

Verification

Parent independently ran:

• Compaction-focused suites: 31 passed.
• Full Harness: 24 files / 243 passed.
• Backend identity/Host/path policy: 28 files / 126 passed.
• Protocol/transcript/Host-provider: 21 files / 91 passed.
• vp check, pnpm run slop-check, git diff --check: pass.

Covers restricted manual/threshold continuation, validation, unexpected tools, injected persistence failure, cancellation, legacy resume, concurrent Sessions, revocation/regrant, restart, foreign-path denial, and actor-specific instruction context. Only harmless isolated fixtures/fake models were used; no production Runs or customer data were modified.

Deliberately separate

#151 remains open: cross-prompt retry suppression, durable compaction failure classification, and localized explicit-retry UX follow in a dependent PR under the approved policy (no automatic repeat after failure, no history discard). Those are not claimed complete here. The old tempDirectory option remains accepted but is ignored for compatibility.