fix: address 8-domain Oracle review findings (C1, C2, M1-M4)

- C1: thinking-prepend unique part IDs per message (global PK collision)
- C2: recover-thinking-disabled-violation try/catch guard on SDK call
- M1: remove non-schema truncated/originalSize fields from SDK interfaces
- M2: messageHasContentFromSDK treats thinking-only messages as non-empty
- M3: syncAllTasksToTodos persists finalTodos + no-id rename dedup guard
- M4: AbortSignal.timeout(30s) on HTTP fetch calls in opencode-http-api

All 2739 tests pass, typecheck clean.

src/shared/opencode-http-api.ts

@@ -81,6 +81,7 @@ export async function patchPart(
         "Authorization": auth,
       },
       body: JSON.stringify(body),
+      signal: AbortSignal.timeout(30_000),
     })
 
     if (!response.ok) {
@@ -122,6 +123,7 @@ export async function deletePart(
       headers: {
         "Authorization": auth,
       },
+      signal: AbortSignal.timeout(30_000),
     })
 
     if (!response.ok) {