feat(acp): capture typed Codex final answers

[reinhold-ph]

Why

Codex ACP exposes an adapter-typed final-answer phase, but buzz-acp currently reduces a completed prompt to a stop reason and discards the classified assistant response. Host-managed reply delivery needs a narrow, fail-closed result boundary before any routing, signing, persistence, or publication work can be added safely.

This PR introduces that classifier boundary only. It does not publish messages or change the user-visible delivery path.

What changed

• collect only agent_message_chunk updates carrying _meta.codex.phase = final_answer for the active ACP session
• require a non-empty messageId, text content, one unambiguous message group, and the exact canonical end_turn terminal response
• discard pre-tool candidates at valid tool boundaries and poison malformed candidates fail-closed
• enforce non-resettable per-prompt byte and chunk budgets, including malformed final-answer chunks
• preserve the typed result across the prompt/control completion race and expose it through PromptResult
• log only message ID and byte count at the current host boundary; delivery remains explicitly out of scope

Safety properties

The classifier returns no deliverable answer for cancellation, refusal, timeout/error paths, noncanonical terminal spellings, blank text/IDs, multiple final-answer IDs, wrong-session updates, malformed tool boundaries, malformed content, or resource-limit exhaustion.

Related work

No direct duplicate was found. This classifier is complementary to block#4648 (empty-turn observability) and is a prerequisite for addressing silent/manual delivery failures tracked in block#2459 and block#5322.

Verification

• cargo fmt --all -- --check
• cargo check -p buzz-acp
• cargo clippy -p buzz-acp --lib -- -D warnings
• cargo test -p buzz-acp --lib — 749 passed, 0 failed
• git diff --check
• independent pre-commit review of the final diff

Scope and next gate

This is the classifier prerequisite for host-managed ordinary-reply delivery. It does not yet provide a UI-testable latency improvement. The next separately reviewed slice must consume this typed result to derive the trusted route and perform durable/idempotent host delivery without another model inference.