feat(tui): browse branches with scoped diagnostics

[danielkov]

Summary

Add F4 and /branches to browse and resume preserved conversation futures in a lineage-aware session tree. Keep asynchronous diagnostics scoped to their producing operations so switching or reloading sessions cannot attribute old work to the active conversation.

Motivation

Completes the navigation and branching stack on #116: read-only navigation in #110, earlier-prompt branching in #115, safe message-boundary continuation in #116, and saved-branch switching here.

Impact

Browsing remains available while streaming; switching requires idle state. Selecting the current session explicitly reloads committed history while preserving its unsent draft and attachments. Switching conversation context does not undo files, commands, or external effects.

Technical details

Derived branch catalog and safe activation

The session tree derives from validated persisted lineage without rewriting history. Legacy sessions remain roots, while orphaned or invalid lineage is labeled without hiding unrelated sessions. The loading dialog owns input immediately, and stale scan or activation results cannot replace a later view. Failed same-session reloads restore bounded parked state and allow disconnected retry.

Immutable diagnostic ownership

Updated ACP v1 peers negotiate version-1 _meta ownership and exchange connection-local operation tokens. Producer scopes survive asynchronous tasks, Runlet execution, reuse, native v1 forks, and nested children; background continuation ownership follows actual result or input consumption rather than the currently displayed session. Mixed or missing provenance stays unattributed. Legacy peers retain immutable launch provenance, and native ACP v2 fork remains unsupported.

Bounded child bookkeeping

Initialization retains at most 256 KiB of stderr while continuing to drain; overflow discards partial lines safely. Negotiated connections retain at most 4,096 issued operation mappings without eviction or token reuse. Exhaustion rejects new prompts and forks with a restart instruction, but close remains available without inventing ownership. Issued mappings survive cancellation and completion through process exit and stderr drain.

[kit-code-agent]

F4 dismissal stops working while a loaded branch browser is editing a search; users must exit search mode before closing it.

[kit-code-agent]

No issues found. The changes look good to merge.