fix(coding-agent): recover command failures and preserve session state

[MelodyVAR]

Foreground commands can stall a non-interactive session when a child process keeps an output pipe open, and shortened error output can hide the information needed to recover. This adds a 120-second default for Step run_command, cleans up discoverable Linux descendants on timeout or abort, reports signal termination as failure, and preserves a readable full log when command output is shortened.

The change also keeps runtime state from interfering with solution delivery:

• STEP_CODING_AGENT_PLAN_DIR optionally stores plans outside the workspace. Existing defaults and saved session paths remain authoritative.
• Compaction preserves prior history and refuses empty replacement summaries. Summary output respects the model limit and the existing 32,000-token ceiling, including when a larger reserve is used to trigger compaction earlier.
• --completion-check git-committed checks delivery in the same session. Optional --completion-review shares the existing follow-up budget.

Explicit command timeouts, background execution, and permission decisions keep their contracts. Linux descendant snapshots cannot atomically contain already-reparented descendants or forks racing the snapshot. This change adds no dependency.

Validation: npm run check and the complete offline ./test.sh suite pass. Coverage includes real local subprocess timeout/signal recovery, complete saved-output reads, plan resume behavior, compaction checkpoint integrity, summary budgets, and the HTTP serializer. CLI dispatch fixtures invoke the workspace build refreshed by CI, preserving their assertions and subprocess deadlines. The full suite was run with a three-CPU affinity limit to avoid oversubscribing this shared host; test timeouts were unchanged. An unchanged 12 MiB feedback-redaction stress test also passed in isolation after timing out during the initial high-concurrency run.

Full benchmark comparison is still in progress; this PR does not claim a final score improvement. Denial-recovery configuration is tracked separately in #188.