fix: harden runtime boundaries and resource lifecycles

[Ingwannu]

What

• Unifies the Vite and production loopback API boundary with bounded JSON parsing.
• Hardens goalplan, recall, subagent configuration, recursion grants, evidence gates, and hook input handling.
• Bounds runner JSONL/output, event-log backpressure, media streaming/concurrency, job retention, maps, timers, and process-group shutdown.
• Improves GUI polling and route splitting, static asset caching, Discord/Telegram isolation, and dependency security.
• Documents the runtime trust boundaries and decision rationale.

Why / root cause

Several independently grown runtime paths had inconsistent trust rules and unbounded resource lifecycles. Oversized or child-controlled input could bypass policy checks, while slow storage, concurrent downloads, stale jobs, event streams, and descendant processes could retain resources indefinitely.

Compatibility and impact

Normal-size API requests, messages, attachments, subagent dispatch, and recent job history keep their existing behavior. Intentional limits affect only overload or unsafe cases:

• enforcement hook stdin and Codex events are bounded and fail closed or report truncation;
• recursive delegation uses a parent-minted one-use capability;
• Git-tracked subagent overrides require a repository-and-digest-bound review token;
• media overload is rejected with a retry message;
• stale running jobs are reconciled after restart;
• old job rows are pruned by count and age.

Verification

• npm test: 1,453 passed, 0 failed
• npm run build: 119 files compiled and layout validated
• GUI production build: Vite 6.4.3, main chunk 159.04 kB / 52.29 kB gzip
• GUI TypeScript check: passed
• npm audit --audit-level=low: 0 vulnerabilities
• npm run gate: passed
• git diff --check: passed
• Independent final diff review: no blocker or high-severity regression found

[github-actions]

✅ Target branch corrected

This pull request now targets dev.

The [WRONG BRANCH] title prefix has been removed. Its existing draft status has been preserved.