feat: sync reviewed 0.5.5 runtime improvements

[hetaoBackend]

Change

The public source tree lagged behind the published 0.5.5 package. This selectively ports reviewed public-compatible behavior while preserving public fixes and distribution ownership:

• Managed Bash uses a one-hour maximum total timeout; the 60-second foreground yield preserves the process and original deadline.
• Context compaction reserves output budget, handles reasoning-only exhaustion and bounded provider retries, and retains history on automatic failure.
• Update downloads reuse the TUI proxy policy with lazy network imports; memory-tool results use bounded head/tail previews.
• Root/TUI versions and bilingual changelogs now identify 0.5.5. The source-update record documents provenance, included behavior and excluded integrations.

Public telemetry remains independently opt-in and disabled by default. Automatic evaluation capture, default-enabled data contribution, workspace snapshots/index uploads and expanded raw diagnostic payloads are not imported. Managed-account, BYOK, plugin and connector support remains intact.

This is a selective port, so the three-way extraction baseline is deliberately unchanged. It neither republishes npm artifacts nor moves existing tags.

Validation

• Clean committed head 2f59befbe7916d9fa7b2249b0e1de187892b85c1, macOS arm64, Node 22.23.2: full pnpm verify PASS, all 15 applicable gates. Capability suite: 184 files, 4,919 passed / 17 skipped. Source export, lint, types, build, standalone boundaries, artifact, TUI status, smoke, BYOK, policy and sandbox checks passed.
• Live smoke using the newly built public CLI, an isolated profile and synthetic workspace: real BYOK model + Read/Bash calls passed, file content/count verified and workspace unchanged. Fullscreen TUI started, /status reported 0.5.5/Ready, and /exit completed successfully. Temporary credentials/profile were removed.
• Gitleaks: all 303 reachable commits and the committed source snapshot passed. Public privacy-sensitive lifecycle, configuration, diagnostic, host-metric and retired-source boundaries were checked against the base.
• Performance: perf:full required. Attempt 1 was INCONCLUSIVE (startup duration and 100-round CPU spread; all 300-round metrics passed), so it is not acceptance evidence. Attempt 2 passed the full suite on head 2f59befbe7916d9fa7b2249b0e1de187892b85c1 against base 4198174c89963ca7614ae7705bb897814d11b4ee: startup, 100-round and 300-round scenarios all PASS. No benchmark thresholds were changed. The initial cancelled run was superseded by this full-suite run.
• Remote CI: source verification passed on Linux, macOS and Windows; release build and installation passed all eight Linux/macOS combinations across Node 22.19.0, 24.2.0, 25 and 26. CodeQL and release audit passed.
• NOT RUN locally: native Windows/Linux runtime acceptance and npm release-archive installation. This PR publishes source only; cross-platform source verification is delegated to CI. Offline tests are not presented as live-service acceptance.

Publication and contribution checks

• I have permission to contribute these changes under the existing licenses applicable to the changed files/packages; imported material and its provenance are identified and existing notices are preserved.
• No credentials, account data, real user content, internal source history or private review material is included.
• Added/removed source files were reviewed before regenerating release/public-source.json; new tests are declared in test/vitest-suites.json where applicable.
• Shared English/Chinese documentation and capability/verification records are updated where applicable. Mock/offline results are not described as live-service acceptance.

Maintainer handoff

Publication scope or license changes: no new package/dependency/license scope. Reviewed additions are tests and the source-update record.

Shared-source port: complete for the explicitly documented 0.5.5 behavior; unrelated ownership migrations and integrations remain deferred for separate review.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}