fix(agent): reconcile plan state and refresh resumed session instructions

[1052326311]

An approved plan can keep spinning after a turn has ended, localized continuation requests can stop incorrectly, and a reused SDK session can keep obsolete instructions even after project context changes.

This consolidates the overlapping work in #55 and #58 into one reviewable series. It separates durable plan results, the active turn and individual tool outcomes, and refreshes the system message when resuming the same session history.

• Stable plan/step IDs, revisions and snapshot reconciliation preserve results across turns, reordering, reloads and interruptions.

• Explicit task-state reporting replaces English-sentence recovery heuristics. Repetition detection compares complete arguments/results; external-tool dispatch acknowledgments are not treated as execution success.

• Cached callbacks bind to the current stream. Changed effective prompts resume the same SDK session with current instructions; failed refreshes cannot silently send stale instructions.

• Final replies and recovery use the same event pipeline. Unknown historical results stay unconfirmed instead of being marked complete.

• Provider timeouts after completed tool calls get one cancellation-acknowledged resume. Unknown tool outcomes, user/input gates, completed reports and non-timeout errors do not trigger replay; repeated failures stop visibly.

• Failure traces persist before the done signal and are projected into history, preserving partial replies and successful tool facts. Live tasks older than five minutes remain discoverable after refresh.

• File tools reject incomplete arguments before side effects with stable metadata; only proven no-effect rejections can participate in bounded recovery.

• Dependency installation and repair share a per-project queue, preventing concurrent package-manager writes from losing dependencies. Preview restart happens outside the lock.

• The command tool honors explicit Docker off/off container isolation with a safe environment, output bounds and timeout handling. Hardened/missing/mixed configurations still require the sandbox; errors never trigger fallback.

• Preview injection scripts are parsed in regression tests, catching JavaScript syntax failures hidden inside TypeScript string literals.

Validation: the runtime-compatible Linux suite passes 138 regression cases, one separate real SDK installation-handler integration case and 13 sandbox checks. The tests cover timeout/cancellation, uncertain outcomes, old failed history, live long-running markers, incomplete arguments, concurrent installation and command configuration. Browser checks confirm persisted failure notices after reload. A real model turn generated a small 3D app; its TypeScript/Vite production build passed, including a direct production command-tool check of the explicit container backend. Earlier three-turn live integration verified current instructions, an in-memory prompt change and persisted-session resume while retaining the same SDK session ID. The optional bilingual Web production build and 10 localization tests pass in #60.

Limits: existing full-tree type diagnostics remain outside this patch. Container mode is for trusted internal use, not cross-project filesystem isolation; the dependency queue is process-local. A long real provider generation still timed out after output truncation. That upstream output limit is not claimed fixed; bounded recovery is covered through the actual event pipeline with injected failures, while smaller complete file operations succeeded against a real model. See docs/plan-progress.md for the contracts and verification boundaries.

Doable branding, English defaults, package names and tool/protocol identifiers are retained. The optional Chinese interface is submitted separately. This PR supersedes #55 and #58 to avoid duplicate review/merges.