fix(desktop,cli): stop rejecting legal edit-and-resend / rewind on structured history

[ggbdpq]

Summary

Part of #5109 — the two behaviors that can be fixed without growing the debt-ratcheted renderer shell files:

Desktop: an edit was refused whenever any earlier retained turn carried an attachment, even though the Runtime Host revision copier already preserves referenced user-upload artifacts and rewrites their Session refs losslessly (integration coverage in session-revision-two-client-uds.test). That stale history scan is gone: a plain-text message edited over attachment-bearing history is now editable. A source message that itself carries attachments (and folder references) stays explicitly rejected, because its rewritten target-owned refs are not exposed to clients yet.

TUI: /rewind refilled only userFacingText(promptMessage) and the replacement submit carried only text — silently degrading a selected turn that carried quotes or attachments. Until the TUI can stage structured context, rewind now refuses with a precise notice instead of dropping content silently (the issue's explicit fail-closed allowance).

Deliberately out of this slice: staging a selected message's quotes into the Desktop revision draft (issue behavior A). A working prototype grew app-shell.tsx / app-shell-revision-actions.ts / use-app-shell-composer-quotes.ts, which are monotonic token-debt files under renderer-architecture.json; whether to spend that budget (or re-home the staging logic in a non-ratcheted module) is a maintainer call, so it is noted as follow-up instead of smuggled in. Same for editing a selected message's attachments (needs the Host to expose rewritten target-owned refs) and TUI quote staging.

Verification

Claim	Evidence
Stale refusal removed	new app-shell-revision-actions.test 2/2: editing a later plain-text message over attachment-bearing history opens the draft; a source message with attachments is still refused explicitly
TUI fail-closed	new driver test: rewind on turns carrying quotes/attachments rejects with a precise message before any session.revision.create
Renderer contract	check-renderer-architecture --base <merge-base>: no debt increase (revision-actions file shrinks; ledger figure follows down); TUI rewind suites 8/8
Builds / format / headers	desktop build:test, ui, maka-agent exit 0; biome clean; ASF headers intact

Known-local-environment notes: the CI check script segfaults in the base-worktree derivation on this Windows machine, so the architecture gate was verified by metric comparison against the ledger (all touched files at or below base) — CI runs it for real.

AI use

Implemented with ZCode (GLM-5.3-Flash): traced the issue's verified implementation boundaries, red-green per slice, narrowed the slice when the renderer token ratchet refused the larger shape, Generated-by trailer in commits.

Checklist

• Earlier retained attachments are copied by the Host; the renderer's stale refusal is removed
• Source messages with attachments / folder references still fail explicitly, never silently
• TUI rewind fails closed with a precise notice instead of degrading content
• Selected-message quotes/attachments restored into the revision draft — follow-up (needs ratchet budget or re-homing)
• Unchanged detection comparing canonical structured content — lands with the follow-up