feat(claude): enable verified native conversation rewind

[rynfar]

Claude could not safely use Pylon's rewind actions through relative turn counts. Eligible completed turns now capture immutable inclusive native forks and support the existing restore-files/keep-files saga, idempotent application, compensation and same-incarnation restart recovery.

Full bounded raw JSONL proof includes hidden context omitted by the SDK message projection. Only source-verified fork metadata is normalized. Scoped file identity checks, a 64 MiB cap and a 30-second proof deadline reject ambiguous or changed history. Source capture quarantines native queries and delayed callbacks before returning its receipt; private recovery metadata preserves the complete selected native conversation.

Native limits remain explicit: empty roots, uncaptured or previous-incarnation checkpoints, pending native work, unsupported history transformations and boundaries removed by compaction remain unavailable. Ordinary resume is preserved. Tests use actual pinned SDK filesystem forks with synthetic temporary history and fake query streams; no live Claude account/model request was performed.

Validation: independent adversarial exact-head SDK/adapter review; 160 focused tests, server typecheck and scoped lint from the saved implementation. All six Claude implementation/test files remain byte-for-byte identical to that reviewed scope. Integration preserves Codex/OpenCode absolute capability settings and passed 135 combined service/capability tests, server types, scoped lint and the server unused-export check. Final-head CI is required before merge.

Part of #526, completing the Claude extension of #513 for upstream fd5553f1afcef4f410a067687faa991743b5034c and efccda9ac9230db22b36990cffabdad218fa41b0. The compact ledger records all reopened exceptions and advances the decision cursor to frozen d1d15c67f4a5fb82fd8d5e01e5e3b288296789c3, whose sidebar source landed in #527. This cursor records authorized dispositions, not universal native compatibility. Automatic merge CI and relay deployment are tracked separately before cycle closure.

Model: GPT-6. Harness: Codex.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[vercel]

Deployment failed for project pylon-marketing with the following error:

Resource is limited - try again in 24 hours (more than 100, code: "api-deployments-free-per-day").

Learn More: https://vercel.com/pylon-code?upgradeToPro=build-rate-limit

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	14.1 KiB	14.0 KiB	−17 B (−0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.2 KiB	7.2 KiB	0 B (0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.8 KiB	6.8 KiB	−17 B (−0.2%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	58.8 KiB	58.8 KiB	−44 B (−0.1%)	66.4 KiB	✅
Codex	Live turn messages	10	9	−1 (−10.0%)	21	✅
Claude	Total thread wire	14.1 KiB	14.0 KiB	−57 B (−0.4%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.2 KiB	7.2 KiB	+10 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.9 KiB	6.8 KiB	−67 B (−1.0%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	59.7 KiB	59.6 KiB	−88 B (−0.1%)	66.4 KiB	✅
Claude	Live turn messages	10	8	−2 (−20.0%)	21	✅

Baseline: 083a172 · PR result: 76a75e9 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 115.6 KiB
• Claude decoded thread snapshot: 116.3 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.