fix(acp): bound the tool-call payload a session snapshot carries

[Adam-Dalloul]

Fixes the unbounded part of #380.

active_tool_calls is cleared in exactly one place, TurnComplete. A turn that keeps working therefore accumulates an entry for every tool call it has ever made, and to_snapshot copied all of them whole. The reporter sampled a turn that had not reached a TurnComplete: 1814 entries / 23.6 MB, then 1983 entries (1964 completed, 18 failed, 1 running) / 26.7 MB, with the server answering in 0.134s and the desktop client unable to send, stop, or switch sessions afterwards.

Nothing could simply drop the finished entries. denormalizeSnapshot resolves each ToolCallRef in the live message through this list and skips a block whose id is missing, so a removed entry is a tool card missing from the middle of the in-flight turn.

So every call still ships, in the same order, with its id, kind, label, status and meta. What is now bounded is the result payload (input / output / content / locations / images), and only on calls that already reached a terminal status: the newest keep everything until a 2 MiB budget is spent, and older ones ship without it. A finished call's result stays durable in the agent's own transcript. Pending and in-progress calls are never trimmed at any size, since their partial output exists nowhere else and their count tracks live concurrency, not turn length.

Sizing reuses the escape-aware, allocation-free estimator event_stream already uses for the per-event cap, split so it can take a plain slice.

Measurement, on the reported shape (one long turn, prose interleaved between the calls, ~12 KB of output plus rendered content per call), serializing the same state before and after:

calls   blocks   before      after     full   trimmed
  200      250   2.43 MiB   2.06 MiB    170        30
  500      625   6.07 MiB   2.16 MiB    170       330
 1000     1250  12.13 MiB   2.32 MiB    170       830
 1983     2479  24.06 MiB   2.62 MiB    170      1813
 4000     5000  48.53 MiB   3.24 MiB    170      3830

Before is linear and unbounded in the number of calls. After, the newest 170 keep their full payload and what remains grows only with the per-call identity fields the refs need.

Unchanged: the in-memory active_tool_calls map (latest_live_reply, the delegation meta writer and the launch-id probe all still read it exactly as before), the snapshot's id-sorted order, every other snapshot field, and the wire shape of any turn whose tool calls fit the budget, which is byte-identical to today.

Not covered here: rendering 1983 tool cards is its own cost, and this PR does not touch the render path.

Three tests in session_state.rs: a normal turn ships byte-identical, a 300-call turn stays near the budget with every ref still resolving and the oldest calls keeping their identity fields, and a running call larger than the whole budget still ships whole.

Does not touch anything in #705, #708 or #703. #703 edits session_state.rs too, but only background_keepalive_max_age.