fix: address 8-domain Oracle review findings (C1, C2, M1-M4)

- C1: thinking-prepend unique part IDs per message (global PK collision)
- C2: recover-thinking-disabled-violation try/catch guard on SDK call
- M1: remove non-schema truncated/originalSize fields from SDK interfaces
- M2: messageHasContentFromSDK treats thinking-only messages as non-empty
- M3: syncAllTasksToTodos persists finalTodos + no-id rename dedup guard
- M4: AbortSignal.timeout(30s) on HTTP fetch calls in opencode-http-api

All 2739 tests pass, typecheck clean.

src/hooks/session-recovery/storage/thinking-prepend.ts

@@ -49,7 +49,7 @@ export function prependThinkingPart(sessionID: string, messageID: string): boole
 
   const previousThinking = findLastThinkingContent(sessionID, messageID)
 
-  const partId = "prt_0000000000_thinking"
+  const partId = `prt_0000000000_${messageID}_thinking`
   const part = {
     id: partId,
     sessionID,
@@ -104,7 +104,7 @@ export async function prependThinkingPartAsync(
 ): Promise<boolean> {
   const previousThinking = await findLastThinkingContentFromSDK(client, sessionID, messageID)
 
-  const partId = "prt_0000000000_thinking"
+  const partId = `prt_0000000000_${messageID}_thinking`
   const part: Record<string, unknown> = {
     id: partId,
     sessionID,