fix: address 8-domain Oracle review findings (C1, C2, M1-M4)

- C1: thinking-prepend unique part IDs per message (global PK collision)
- C2: recover-thinking-disabled-violation try/catch guard on SDK call
- M1: remove non-schema truncated/originalSize fields from SDK interfaces
- M2: messageHasContentFromSDK treats thinking-only messages as non-empty
- M3: syncAllTasksToTodos persists finalTodos + no-id rename dedup guard
- M4: AbortSignal.timeout(30s) on HTTP fetch calls in opencode-http-api

All 2739 tests pass, typecheck clean.

src/shared/opencode-http-api.test.ts

@@ -87,14 +87,15 @@ describe("patchPart", () => {
     expect(result).toBe(true)
     expect(mockFetch).toHaveBeenCalledWith(
       "https://api.example.com/session/ses123/message/msg456/part/part789",
-      {
+      expect.objectContaining({
         method: "PATCH",
         headers: {
           "Content-Type": "application/json",
           "Authorization": "Basic b3BlbmNvZGU6dGVzdHBhc3N3b3Jk",
         },
         body: JSON.stringify(body),
-      }
+        signal: expect.any(AbortSignal),
+      })
     )
   })
 
@@ -145,12 +146,13 @@ describe("deletePart", () => {
     expect(result).toBe(true)
     expect(mockFetch).toHaveBeenCalledWith(
       "https://api.example.com/session/ses123/message/msg456/part/part789",
-      {
+      expect.objectContaining({
         method: "DELETE",
         headers: {
           "Authorization": "Basic b3BlbmNvZGU6dGVzdHBhc3N3b3Jk",
         },
-      }
+        signal: expect.any(AbortSignal),
+      })
     )
   })
 

src/shared/opencode-http-api.ts

@@ -81,6 +81,7 @@ export async function patchPart(
         "Authorization": auth,
       },
       body: JSON.stringify(body),
+      signal: AbortSignal.timeout(30_000),
     })
 
     if (!response.ok) {
@@ -122,6 +123,7 @@ export async function deletePart(
       headers: {
         "Authorization": auth,
       },
+      signal: AbortSignal.timeout(30_000),
     })
 
     if (!response.ok) {