Prevent oversized Mainline hook context from exhausting model prompts

Summary

• Replace full session-start status and sync payloads with compact, actionable summaries.
• Preserve the active intent ID and goal, agent authority boundary, important counts, omitted-item counts, and commands for loading details on demand.
• Enforce UTF-8-safe renderer budgets of 32 KiB for session-start context and 16 KiB for per-prompt context.
• Add defensive Pi extension limits for subprocess stdout, individual hook context, and combined injected context.
• Add regression fixtures containing hundreds of turns, uncovered commits, and proposals without logging omitted content.

The shared renderer change also protects Claude Code, Codex, and Cursor. On the same large repository fixture, all four agents now receive approximately 4 KiB of session-start context instead of approximately 6.7 MB.

Validation

• go test ./...
• go vet ./...
• go test -race ./internal/hooks/...
• git diff --check
• End-to-end opencad hook-size verification:
  • Before: approximately 6,728,087 bytes of injected context
  • After: 3,992 bytes
  • Required active-intent, authority, omission-count, and follow-up-command fields remain present

Review notes

The core incident is fixed for every agent using the shared renderer. The Pi extension additionally provides host-side defense in depth. Follow-up hardening opportunities identified during review—avoiding full in-memory serialization before compaction, adding a common host-output boundary for other agents, and bounding Pi stderr—are non-blocking and outside this fix's scope.