Preserve exact shell review and queue authority on v4.20.0 main

[AetherAI3]

Residual #281 / #284 safeguards integrated with current main

This preserves the reviewed shell-attachment and queue-authority fixes while integrating main 835bd1f (#316–#318). Current main's v4.20.0 version, release workflows, and operator packets are unchanged by this PR. The historical #303 / v0.4.0 packet repair is not included.

#281 safeguards

• The entire attachment, including metadata and protected trust/omission framing, stays within 8 KiB
• Removed metadata cannot reappear; mask/redact affect only editable content
• Reviewed bytes remain exact under project-rule framing and stay out of blocked-submission history/custody exports
• Line/drop/replace/mask/redact UI, JSON records, and explicit fresh-capture script Send remain available

#284 safeguards

• Send queues one immutable approved snapshot; later same-capture edits/cancellation cannot change it
• Retained snapshots count toward the existing 64 KiB queue bound; failed admission preserves the exact edited draft for retry
• Malformed pasted controls remain local; checkout/session changes discard stale queued work; terminal handoff cannot change a pending queue's context
• Existing feat(console): inspect, edit, and cancel queued chat and shell commands (#284) #315 IDs, edit/remove/clear/resume UI and hold-after-chat-failure behavior, feat: opt-in persistent PowerShell console session #312 PowerShell profiles, and feat(chat): deliver /steer to the active turn with an honest acknowledgement (#283) #314 live steering are preserved

Final integrated verification

Exact local tree 0654b03f54e0cd32d09d8c837affef3755ee840d, Linux Node.js 24.19.0:

• Focused console/attachment/queue/profile/steering: 60 passed, 4 platform skips, 0 failures
• Full npm test: 3,410 passed, 15 platform/environment skips, 0 failures (3,425 total)
• Build, typecheck, lint, docs:check, verify:production, npm pack --dry-run and git diff --check passed
• Live release:truth passed 12/12
• Smoke still fails this executor's public DNS resolution for example.com; unsigned model checks skip. No paid model calls or real credentials were used

The previous README example and current-version release-truth blockers are cleared by main's own release changes. Actual required CI remains authoritative: artifact quota, private ATS checkout access, and the reported Windows progress-timeout baseline are not weakened or modified here. Native Windows execution is not claimed from this Linux run.

See docs/issue-281-284-residual-validation.md for separately reproduced #281/#284 acceptance evidence. No automatic issue closure or live-service qualification claim.